RAID can keep a network-attached storage (NAS) system available after certain drive failures, but it does not by itself recover deleted or ransomware-encrypted files. Separate backups, remote-access controls and hardware capabilities address different aspects of storage protection and performance.
RAID and backups address different failures
Fault tolerance depends on the RAID configuration. A two-drive mirror maintains duplicate data on both disks, allowing the surviving disk to retain the files after one fails. Deleting files or encrypting them through ransomware can affect the array’s working data despite that redundancy.
A separate backup provides another recovery copy. Western Digital’s RAID documentation distinguishes protection against drive failure from protection against accidental deletion, ransomware, corruption and disasters affecting the equipment.
Synology’s backup documentation describes the 3-2-1 model as three copies of data, including the working copy, on two storage media, with one copy offsite. Its Hyper Backup software supports destinations including external drives, other servers and cloud storage, with data and transmission encryption.
The October 2023 #StopRansomware Guide, developed by CISA, the FBI, the NSA and the Multi-State Information Sharing and Analysis Center, recommends offline, encrypted backups and regular recovery testing. It warns that attackers seek accessible backups to delete or encrypt and can use stolen credentials to access backup systems. A connected backup therefore requires protection against access through the compromised environment.
Snapshots preserve earlier states of stored data and can support recovery from unwanted changes. Synology describes local recovery copies as useful for deleted or corrupted files, while warning that hardware failures can still cause data loss. Its guidance pairs local copies with backups to another destination. Snapshot replication can place recovery copies on another NAS; snapshots held only on the original device do not create an offsite copy.
Remote access changes internet exposure
Router port forwarding can make NAS services accessible from outside the local network. UPnP can configure forwarding automatically, so internet exposure can involve both manually configured rules and mappings created by devices.
In guidance published in 2022, QNAP recommended disabling manual port forwarding and UPnP automatic forwarding for its NAS devices. The company also described remote access through a VPN server on a router or through its NAS VPN software.
Historical ransomware research illustrates the exposure involved. Palo Alto Networks’ Unit 42 researchers documented an eCh0raix variant targeting QNAP and Synology devices. They also observed attacks exploiting CVE-2021-28799, an improper-authorization vulnerability in QNAP’s Hybrid Backup Sync software, to deliver the ransomware. Those findings concern past attacks.
Tailscale says its Synology package allows designated users to access a NAS remotely without opening firewall ports and supports access-control lists. WireGuard provides another VPN technology for encrypted connections. These access methods still require authentication, software maintenance and appropriate access restrictions.
Drive suitability depends on specifications
Continuous operation, vibration tolerance and error handling distinguish storage-array requirements from many desktop uses. The TrueNAS CORE 13.0 hardware guide discusses those differences when comparing desktop, enterprise and NAS-oriented disks.
The guide identifies WD Red Plus as a NAS-drive family using conventional magnetic recording, or CMR. Seagate describes its IronWolf line as designed for multi-bay NAS systems and 24/7 operation. These are product-specific characteristics, rather than evidence that every desktop disk will fail in a NAS.
A NAS designation alone does not establish recording technology. The TrueNAS guide notes that NAS disks can use either CMR or shingled magnetic recording, known as SMR. iXsystems advises against SMR drives for TrueNAS or ZFS, citing slower writes and possible instability or data loss during resilver operations.
SSDs introduce separate considerations, including write endurance and cost per unit of capacity. Neither a NAS label nor a particular storage medium replaces an independent backup.
Applications have hardware limits
Some NAS hardware can run applications beyond file storage. QNAP describes support for virtual machines and containers on compatible devices, while media-server support varies by model.
A Plex media server illustrates the difference between storing video and processing it for playback. Plex says transcoding can be CPU intensive and that many NAS processors have limited performance for that task. Its documentation states that transcoding is disabled on some low-power devices, primarily models with ARM-based processors.
Those limitations do not establish a universal performance ranking for ARM, Intel or AMD hardware. Plex directs users to model-specific compatibility information, which it describes as a general guide rather than a performance guarantee.
DIY platforms also have their own hardware requirements. The TrueNAS CORE 13.0 guide recommends 8 GB of RAM and describes deployment on repurposed x86 computers or custom builds. That recommendation applies to the specified platform; it is not a memory requirement for every NAS.
Network bandwidth can constrain storage transfers
A single gigabit Ethernet connection has a theoretical data rate equivalent to 125 MB/s before overhead. Faster disks cannot raise the bandwidth of that connection.
QNAP’s transfer-speed documentation identifies storage devices, simultaneous users, running tasks and client-device connections as additional constraints. A background backup or a slower client connection can therefore limit transfers even when the NAS has a faster network interface.
Connections using 2.5GbE and 10GbE provide higher nominal bandwidth than gigabit Ethernet. That link rate is distinct from achieved file-transfer speed.
TP-Link’s specifications for its TL-SG105-M2 switch list automatic negotiation at 100 Mb/s, 1 Gb/s or 2.5 Gb/s. The company says actual performance varies with cable quality, client limitations and environmental factors. Those specifications do not establish a particular transfer result for an individual NAS installation.
Accounts and monitoring remain separate controls
Authentication and permissions govern access independently of drive redundancy. The October 2023 #StopRansomware Guide recommends limiting users to the access required for their work, restricting administration and removing unnecessary accounts.
Synology’s security guidance recommends disabling the default administrator account, using strong and unique passwords, enabling two-step verification and maintaining software updates. It also describes controls for repeated failed sign-ins, firewall restrictions and disabling unused terminal services.
Monitoring covers operational problems as well as login activity. Synology describes notifications for storage volumes running out of space and failed backup or restoration tasks. These alerts provide information about conditions that require attention; they do not themselves restore data or complete a failed backup.
Capacity and power affect expansion
Drive bays, disk capacity and array layout affect usable storage and expansion options. Mirroring uses capacity for duplicate data, so the total capacity printed on the installed drives differs from the space available for files.
The TrueNAS hardware guide discusses selecting storage for both immediate needs and future expansion. It also identifies the motherboard and number of drives as factors in power-supply sizing, including anticipated future loads.
Electricity costs depend on power consumption over time and the local electricity tariff. Hardware purchase costs, expansion components and ongoing electricity use are separate parts of the comparison between a dedicated NAS and a repurposed computer.
