A NAS is the most sensible purchase a small business can make for shared files. It is also the device we most often find configured in a way that will not survive the thing it was bought to protect against.
Four corrections, in order of how much trouble they cause.
1. RAID is uptime, not backup
RAID protects against one specific failure: a disk dying. That is a real risk and worth protecting against, so the feature earns its place.
It does nothing about the failures that actually destroy small business data:
- Someone deletes the folder. RAID faithfully replicates the deletion across every disk.
- Ransomware encrypts the share. RAID keeps the encrypted version safe and redundant.
- The NAS itself fails — power supply, controller, firmware, a bad update.
- It is stolen, or the building floods.
“We have RAID” and “we have a backup” are unrelated statements, and the gap between them is where the expensive Mondays live. A NAS needs backing up exactly like any other machine — which usually means an off-site copy, ideally one the NAS cannot itself delete. The 3-2-1 note covers what that looks like.
2. Snapshots are the feature you already paid for
If your NAS runs Btrfs or ZFS — most Synology, QNAP and TrueNAS boxes do — you can take filesystem snapshots. Turn them on. This is the single highest-value change available on a typical small business NAS, and it is usually switched off.
A snapshot is a read-only point-in-time view of the volume, taken in seconds, costing only the space of what has changed since. With hourly snapshots retained for a week and daily for a month, you get:
- File deleted by accident → restored in under a minute, by you, without touching a backup
- Ransomware encrypted the share → roll the volume back to an hour before it started
- Someone overwrote the master file → the previous version is right there
Crucially, snapshots taken by the NAS are not writable by the client machine that got infected. Ransomware running on a workstation encrypts what it can reach over SMB; it cannot reach the snapshot store. That property is what makes this far more valuable than it sounds.
It is still not a backup — a dead NAS takes its snapshots with it — but it covers the overwhelming majority of real incidents, and it covers them in minutes rather than days.
3. Do not put it on the internet
Every year brings another mass-exploitation campaign against internet-exposed consumer NAS devices. The pattern is identical each time: a vulnerability in the vendor’s web interface or file-sharing service, automated scanning, and a large number of devices encrypted within days. The vendors patch quickly. The devices that get hit are the ones running firmware from eighteen months ago, which is most of them.
So: no port forwarding to the NAS. None. Not the web interface, not SMB, not the vendor’s remote access feature, not “just this one port so I can get files from home.”
If you need access from outside the office, use a VPN or a mesh overlay. The device becomes unreachable from the internet entirely, and remote staff reach it exactly as if they were at their desk. This is a well-solved problem and it costs nothing — mesh VPN covers the modern approach.
While you are in there: put the NAS on a servers segment rather than the same flat network as the guest Wi-Fi and the cameras, for the reasons in this note.
4. Permissions that survive an employee leaving
The default state of a small business NAS is one share called Data that everyone can read
and write, plus a folder called HR that everyone can also read and write but has been
asked not to.
Two habits fix most of this:
- Assign permissions to groups, never to people. When someone leaves you disable one account instead of hunting through fourteen shares. When someone joins you add them to a group instead of guessing what the last person had.
- Separate the things with different audiences — finance, HR, client work, general. Not because you distrust your team, but because “everyone can reach everything” means one compromised laptop can reach everything too.
And set an admin account that is not called admin, with a password from your password
manager and two-factor enabled. NAS admin interfaces are a favourite target precisely
because they so often still have factory-shaped credentials.
Choosing one, briefly
For most small offices: a two- or four-bay unit from a mainstream vendor, disks rated for NAS use (specified for continuous operation and vibration, and slightly more expensive for good reason), and the capacity you think you need doubled — you will fill it faster than you expect.
Two upgrades worth the money: more RAM if you plan to run applications on it, and 2.5-gigabit or faster networking if people work with large files, because on a modern NAS the network is the bottleneck long before the disks are.
One thing not worth the money: the highest-end model, unless you have a specific reason. The mid-range unit does the same job for a business of your size.
The five-minute audit
Go and check these now:
- Are snapshots enabled, and do you know how to restore one?
- Is anything on the NAS reachable from the internet?
- When did the firmware last update?
- Is there an off-site copy of what matters, and has anyone restored from it?
- Does a departed employee’s account still exist?
If four of those five are fine, you are ahead of most businesses we look at. If you cannot answer them, that is the more common position, and it is worth an afternoon.
We design and configure shared storage, backup and remote access remotely — see Backup & recovery or Networks & Wi-Fi.