A NAS feels like the best of both worlds: all your files in one central location, always accessible, without having to park them at a large cloud company. More modern NAS systems can even be neatly divided — some private, some business. Sounds safe and clear.
But precisely because such a device is always on and connected to your network (and often the internet), the question is justified: how safe is it really? What do you protect with it, what can you still add, and where are the dangers?
In this article, we’ll walk through it honestly — without scaremongering, but also without glossing over the risks. At the end you know exactly which buttons matter.
Why a NAS is useful and vulnerable
A NAS is essentially a small, always-on computer with all your data on it. That’s exactly why it works so well: photos, documents, backups and even your own apps run centrally, accessible to everyone in the home or office.
But those same conveniences — remote access, file sharing, app installation — are also the attack surface. Every position you open is a possible entry. A NAS is therefore not “secure” or “insecure” in itself; it depends almost entirely on how you set it up.
Separating private and business: useful, but not an iron wall
Many NAS systems let you divide storage into separate volumes, folders and users — for example, one private environment, one business environment. That is valuable: data is separated, different rights per part, and you can back up per environment.
Important to know: such a split is especially important organization, no hard security wall. Private and business usually run on the same device and operating system. If the NAS itself is compromised — via the administrator account or a leak in the firmware — an attacker can often simply transcend that separation.
There is more to sensitive business data than just technology. You have to deal with the GDPR: think about backups, being able to report a data breach and who can access what. With really sensitive data, the question is justified whether a logical division is sufficient, or whether you would prefer separate hardware or a separate network.
What security you have (and can enable)
The good news: a NAS offers excellent tools to protect your data. You just have to turn it on.
- Access management — work with users, groups and permissions per folder. Give everyone only what is necessary.
- Strong passwords + 2FA — especially on the administrator account. Two-step verification is your most important lock.
- Encryption — encrypt your volumes (data “at rest”) and use HTTPS or a VPN for traffic in transit.
- Updates — keep firmware and apps up to date. Known leaks are exploited automatically.
- Disable unnecessary services — disable protocols that you do not use (such as UPnP and the outdated SMBv1).
- Snapshots and backups — the most important one. More about that in a moment.
The greatest dangers
What goes wrong in practice? The biggest risks, in order of how often they really cause misery:
- Connect the NAS directly to the internet. Making it directly accessible via port forwarding or UPnP is risk number one. Botnets continuously scan the internet for open NAS panels. One weak password or known leak, and you’re open.
- Ransomware. There have been entire waves of attacks that specifically encrypt NAS systems and demand ransoms. The problem: if your snapshots or backups are also accessible, they often last.
- Weak or default passwords and a wide open administrator account.
- Outdated firmware with known vulnerabilities.
- RAID is not a backup. RAID protects against one failed drive — not ransomware, theft, accidental deletion, or fire.
- Physical theft. Without encryption, all your data will literally be on the street if it is stolen.
- False security of “the split” — see above.
Zoom in on a concrete example: the Ugreen NASync DXP6800 Pro
How does this work out on a real, modern device? Take the Ugreen NASync DXP6800 Pro. That’s not a simple drive bay: a 10-core Intel Core i5, DDR5 memory (expandable), six drive bays plus two M.2 NVMe slots, double 10GbE and even Thunderbolt 4. In short, a full-fledged small server. That power has direct consequences for your security — for better or for worse.
You can make the split stronger here. Because the device supports Docker and virtual machines, you can not only put private and business in separate folders, but in separate containers or VMs. That provides a much more real isolation than individual shares — although it remains the same physical host, so a leak in the underlying layer also overcomes that.
It runs on UGOS Pro, a young and proprietary operating system. Ugreen is relatively new in NAS land. This means: fewer years of hardening and a shorter track record than the established names (which themselves had major incidents). Advantage: a smaller target for the time being. Disadvantage: less proven. The lesson: Firmware updates are extra important here — install them quickly.
Remote access is via Ugreen’s own app. Handy, because you don’t have to open a port for it (exactly what you want to avoid). Downside: you rely on Ugreen’s cloud infrastructure and your Ugreen account. So set a strong password and 2FA, or choose your own VPN for maximum control.
Turn on the built-in locks. The device supports encryption, various RAID levels (0/1/5/6/10) and backups. Encrypt your sensitive volumes, and remember: RAID 5 or 6 is not a backup — it catches a failed drive, not ransomware or theft.
You are not stuck with the default OS. Because this is regular x86 hardware, advanced users sometimes run a proven alternative on it (such as TrueNAS or Unraid) for a more mature ecosystem. And with that i5 plus Docker you can even take your security into your own hands: a WireGuard VPN, a reverse proxy with HTTPS, or your own backup tooling — all locally.
This is how you turn an open door into a safe
With a handful of choices you can move a NAS from “open door” to “secure vault”:
- Don’t hang it on the internet. Need remote access? Do this via a VPN (such as WireGuard or Tailscale), not via an open port.
- Turn on 2FA and use a strong, unique administrator password.
- Enable encryption on your volumes.
- Make real backups. Use the 3-2-1 rule: three copies, on two types of media, with at least one copy elsewhere and preferably offline or unalterable. That will save you from ransomware.
- Keep firmware current and turn off unused services.
- Segment your network — a separate VLAN or firewall rules for the NAS.
- Business data? Think of AVG: backup, logging and possibly a separate environment.
The gist in one paragraph
A NAS can be extremely safe — or a risk. The difference is almost entirely in how you set it, because factory settings mainly focus on convenience. If you do not connect the NAS to the internet, use 2FA and encryption, and make real backups, then you have your data firmly in your own hands. And that handy division between private and business? Use it for an overview — but don’t mistake it for an iron wall.
Do you want to organize your own storage safely? Brainfusion is happy to help with that — from safe ones self-hosted storage to backups that survive a ransomware attack. Please contact us.