the NAS hardening baseline everyone should ship with

why your nas is basically a target with a bow on it

network attached storage boxes sit on your network 24/7, hold everything you care about, and most people set them up once and never touch the settings again. that combo is exactly what ransomware crews look for. there have been multiple mass-exploitation waves against consumer and small-business nas brands, not because someone specifically hated your family vacation photos, but because the boxes were sitting there with default settings and known vulnerable services exposed to the internet. this isn't a "you got personally hacked" problem, it's a "you left a window open in a neighborhood where people check windows" problem.

here's the baseline every nas should ship with, and since most don't, you're going to set it up yourself. none of this requires special tools, just twenty minutes in your nas admin panel.

step 1: kill ftp, lock down to https only

ftp is an ancient protocol that sends credentials and files in plain text. no encryption, no protection, nothing. if your nas has ftp enabled, anyone intercepting that traffic on the wire (or sniffing an unsecured network) gets your login straight up. a lot of nas devices enable ftp by default for "compatibility" and then nobody ever turns it off.

go into your nas admin panel, find the file services or network services section, and check if ftp is running. if you don't actively need it, disable it. same goes for telnet and any other legacy plaintext protocol sitting around. for admin access, only use the https management port, never the plain http one. if your nas offers both, http should be off entirely so there's no accidental fallback.

step 2: turn off the vendor's remote-access relay and upnp

most nas vendors push you toward their own "cloud" remote access feature during setup, the kind that lets you hit your nas from your phone anywhere in the world without configuring anything. convenient, sure. it also means your nas is phoning home to the vendor's relay servers and punching a hole through your router automatically using upnp, often without you ever seeing what port got opened.

upnp is the bigger issue here. it lets devices on your network open ports on your router without asking you first. that's great for convenience and terrible for security, because it means any compromised device, or any vendor feature you forgot you enabled, can expose a service to the entire internet with zero visibility on your end.

turn off upnp at the router level. go into your nas settings and disable the vendor's remote access relay feature too. if you genuinely need remote access, use a vpn into your own network instead, that way nothing is exposed directly to the internet and you control the door.

step 3: kill the default admin account, enable 2fa

almost every nas ships with a default administrator account, usually named "admin," and mass scanning tools specifically hunt for that account name paired with weak or default passwords. even if you set a strong password on it, the account name itself is a known target, so leave that account disabled or renamed and create a separate admin account with a unique name.

then turn on two factor authentication for that account. this one step alone blocks the vast majority of automated credential-stuffing attempts, because even if your password leaks somewhere, the attacker still needs your second factor. most nas platforms support authenticator apps natively now, there's no excuse to skip this.

step 4: schedule immutable snapshots

this is the part that actually saves you when everything else fails. snapshots are point-in-time copies of your data, and immutable snapshots specifically cannot be altered or deleted, not even by an admin account, not even by ransomware that's gained full access to your nas.

set up a scheduled snapshot policy, daily is reasonable for most home setups, and make sure immutability is turned on with a retention lock period. if ransomware encrypts your live files, you roll back to the last clean snapshot and you're done. no ransom, no negotiation, no crying over irreplaceable photos. this is the single biggest difference between "mildly annoying tuesday" and "losing a decade of family memories."

the takeaway

none of these four steps require buying anything or being a network engineer. disable plaintext ftp, kill upnp and the vendor relay, replace default admin with a named account plus 2fa, and turn on immutable snapshots. do all four and you've closed off the exact attack path that mass nas ransomware campaigns rely on. go check your own box today, and yeah, send this to whoever in your family has the nas with all the kid photos on it. they'll thank you later.