Complete Synology DSM Security Hardening Checklist

Synology

Installing antivirus software on a Synology NAS can provide another layer of protection, but antivirus alone does not make a storage system secure.

A Synology NAS may contain business documents, employee backups, Microsoft 365 data, virtual machines, surveillance recordings, databases, and years of archived information. If an attacker compromises an administrator account or exploits an exposed service, simply scanning files for malware may do little to stop the attack. Effective Synology security therefore requires a layered DSM hardening strategy combining account protection, network controls, updates, monitoring, snapshots, backups, and recovery planning.

The following checklist provides a practical starting point for securing a Synology environment beyond Antivirus Essential.

1. Keep DSM and Packages Updated

Security hardening starts with patch management.

Synology regularly releases DSM and package updates addressing vulnerabilities, compatibility issues, and other problems. Administrators should monitor available updates and review Synology security advisories. Do not focus exclusively on DSM itself. Packages such as Synology Drive, Hyper Backup, Container Manager, Surveillance Station, and other installed applications can also require security updates.

For business environments, updates should be planned and tested rather than ignored indefinitely.

2. Disable the Default Admin Account

Attackers prefer predictable usernames.

Create a separate administrator account with a unique username and strong password, verify that it works correctly, and disable the default administrator account where appropriate. Employees should also use standard accounts for normal work instead of administrator credentials. Administrative privileges should be reserved for tasks that genuinely require them.

3. Require Strong Authentication

Passwords remain one of the most common weaknesses in network infrastructure. Every account should use a strong, unique password that is not reused across email, cloud services, or other business systems. Multi-factor authentication provides an additional layer. Even if an attacker obtains a password through phishing, credential stuffing, or another breach, MFA can make unauthorized access substantially harder.

Require stronger authentication particularly for:

Administrators
Remote users
IT personnel
Accounts accessing sensitive data
Backup administrators

Protecting privileged accounts should receive the highest priority.

4. Configure DSM’s Built-In Firewall

Many Synology systems are deployed without properly configuring DSM Firewall.

That misses an important security control. Firewall rules can restrict traffic according to factors such as network interface, IP address, subnet, service, and port. Instead of allowing every device to communicate with every NAS service, administrators can create rules based on actual business requirements.

For example, SMB file sharing might be accessible only from internal networks, while administrative interfaces could be limited to specific management systems or trusted subnets.

The principle is straightforward:

Allow what the business needs and restrict what it does not.

5. Avoid Unnecessary Internet Exposure

A NAS should not automatically be exposed directly to the public internet simply because employees need remote access.

Review:

Router port forwarding
DSM services
Reverse proxy configuration
QuickConnect requirements
VPN access
Public applications
Firewall policies

Every externally accessible service increases the potential attack surface.

For business environments, secure VPN architecture or another carefully controlled remote-access method may be preferable to exposing DSM management interfaces directly.

6. Use Security Advisor

Synology includes Security Advisor to help administrators identify potentially dangerous DSM configurations and suspicious activity.

Security Advisor can examine areas such as:

Account security
Network configuration
System settings
Available updates
Malware
Suspicious login activity

Administrators can select security baselines according to the environment.

However, Security Advisor should be treated as a useful auditing layer rather than proof that the NAS is completely secure.

Passing an automated scan does not replace thoughtful architecture and ongoing monitoring.

7. Enable Auto Block and Account Protection

Repeated login attempts can indicate brute-force or credential-guessing attacks. DSM provides controls that can help respond to suspicious authentication behaviour. Auto Block can block IP addresses after repeated failed login attempts, while Account Protection can provide additional defenses against attacks targeting specific accounts. These controls become particularly important when any DSM-related service is remotely reachable. Administrators should also review login logs instead of assuming automated blocking catches every threat.

8. Apply Least-Privilege Permissions

Ransomware does not necessarily need administrator access to cause serious damage.

If a compromised employee account has write permissions across several shared folders, ransomware running under that user’s credentials may be able to encrypt everything the user can modify.

Review permissions for:

Shared folders
Department data
Backup repositories
Applications
Administrative functions
External collaborators

Employees should have access only to the information required for their roles.

Avoid giving broad read/write permissions merely because doing so is easier to administer.

9. Segment the Synology NAS From Other Devices

Network segmentation can limit how easily an attack spreads.

A business network may contain:

Employee computers
Servers
NAS systems
Surveillance cameras
Printers
IoT equipment
Guest devices
Backup infrastructure

These systems do not necessarily need unrestricted communication with each other. VLANs, firewall rules, and separate network segments can reduce lateral movement if one endpoint becomes compromised. Backup infrastructure deserves particularly careful isolation because attackers increasingly attempt to destroy recovery copies before encrypting production data.

10. Use Btrfs Snapshots Where Supported

Antivirus attempts to identify malicious files.

Snapshots solve a different problem: recovery after data has changed.

With supported Btrfs volumes, Synology Snapshot Replication can maintain point-in-time copies of shared folders and supported workloads.

Snapshots can be extremely useful after:

Accidental deletion
Unwanted modification
Ransomware encryption
Administrative mistakes

Frequent snapshots can reduce the amount of data lost between recovery points.

But snapshots on the same system should not become the only backup.

11. Add Immutable Snapshots Where Appropriate

One of the most important developments in modern ransomware defense is making recovery data harder for attackers to delete.

Supported Synology configurations can use immutable snapshots, which cannot be deleted during a defined protection period.

This matters because sophisticated ransomware operators may deliberately target backups and snapshots.

If an attacker gains administrative access and can simply delete every recovery point, ordinary snapshots provide less protection.

Immutability creates a period during which protected recovery points cannot easily be removed, strengthening the organization’s ransomware recovery architecture.

12. Maintain Independent Backups

A secure NAS still needs backup.

RAID protects against certain drive failures. Snapshots provide rapid point-in-time recovery. Neither should automatically be treated as a complete disaster recovery strategy.

A stronger architecture might look like:

Production data → Local snapshots → Independent backup → Offsite/isolated copy

Businesses can use appropriate Synology technologies such as Hyper Backup, Active Backup solutions, Snapshot Replication, or other backup platforms according to their requirements.

The key is maintaining recovery copies across different failure domains.

13. Protect Backup Credentials Separately

If production administrators and backup administrators use identical credentials, an attacker who compromises one privileged account may gain access to everything.

Where practical, separate:

Production credentials
Backup credentials
Administrative accounts
Replication accounts
Service accounts

Apply the minimum permissions required for each function.

A backup architecture becomes much stronger when compromising the production environment does not automatically provide unrestricted control over every recovery copy.

14. Configure Security Notifications

Security controls are less useful if nobody knows when something unusual happens.

Configure notifications for important events such as:

Failed login attempts
Blocked IP addresses
Storage degradation
Backup failures
System updates
Hardware problems
Unexpected service events

Alerts should reach people who can actually respond.

For critical business environments, monitoring should not depend on someone remembering to manually open DSM every morning.

15. Review Installed Packages and Services

Every unnecessary application increases complexity and potentially expands the attack surface. Periodically review installed DSM packages. Remove unnecessary packages and disable unused services.

The same principle applies to Docker containers and virtual machines hosted on the NAS. A poorly secured third-party container can introduce risk even when DSM itself is correctly configured.

16. Test Recovery Before an Attack

A successful backup notification does not prove that the organization can recover.

Businesses should periodically test:

File restoration
Folder restoration
Snapshot recovery
Backup restoration
Offsite recovery
Critical application recovery

For important systems, disaster recovery testing should also measure Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

The question is not simply whether a backup exists.

It is whether the organization can restore usable data quickly enough to continue operating.

Synology DSM Security Hardening Checklist

A practical security review should confirm that:

DSM and packages are updated.
Default administrator accounts are disabled where appropriate.
Strong unique passwords are enforced.
MFA is enabled for privileged accounts.
DSM Firewall rules are configured.
Unnecessary internet exposure is removed.
Security Advisor is regularly reviewed.
Auto Block and Account Protection are enabled appropriately.
User permissions follow least privilege.
Network segmentation is implemented where required.
Btrfs snapshots are configured where supported.
Immutable snapshots are considered for critical data.
Independent backups exist.
Offsite or isolated recovery copies are maintained.
Backup credentials are separated.
Security notifications are configured.
Unnecessary packages and services are disabled.
Recovery procedures are periodically tested.

Antivirus can remain part of this architecture, but it should be viewed as one security layer rather than the security strategy itself.

Building a Layered Synology Security Strategy

The strongest Synology environments combine prevention, detection, containment, and recovery.

Firewalls and account controls reduce unauthorized access. MFA makes stolen passwords less useful. Network segmentation limits lateral movement. Security Advisor and monitoring help identify suspicious activity. Snapshots provide rapid recovery, while immutable and independent backups help preserve recovery options when an attacker attempts to destroy them.

This layered approach is particularly important for businesses because a Synology NAS may contain both production information and the backups needed to recover from an attack. Harden your NAS with a professional Synology security check-up.

Securing only the DSM login page is therefore not enough. The NAS should be considered part of the organization’s broader cybersecurity and disaster recovery architecture.

About Epis Technology

Epis Technology helps businesses secure Synology environments beyond basic antivirus protection. Services include Synology security assessments, DSM hardening, firewall and network segmentation, ransomware protection, MFA and access-control planning, immutable backup architecture, snapshots, business backups, Microsoft 365 and Google Workspace protection, disaster recovery testing, and ongoing Synology support. Epis Technology can help organizations identify security gaps and build layered protection around both production data and the recovery systems needed when an incident occurs.