How to Protect a Synology NAS from Ransomware

Prerequisites

• Sign in to DSM with an administrator account and identify your NAS model, DSM version, and shared folders containing important data.

• Check whether the NAS and its volumes support the protection features below. Shared-folder snapshots require Btrfs, and support for immutable snapshots depends on the NAS. Available options can differ by model and DSM version.What can I do to enhance the security of my Synology NAS?

• Before restoring or rolling back data, confirm that you have a separate, usable backup of the current data. A mistaken restore can replace files you still need.

1. Reduce the ways attackers can reach the NAS

1. Keep DSM and installed packages up to date. Use Security Advisor routinely to scan for vulnerabilities and abnormal login activity, then review its recommended changes.How can I prevent ransomware attacks on my Synology device?

2. Limit access to services you actually use. On your router, avoid opening public ports for services that do not need internet access. If you need to manage DSM remotely, Synology recommends using a VPN rather than exposing DSM management ports directly to the internet.What can I do to enhance the security of my Synology NAS?

3. Avoid using unencrypted FTP for file transfers. Synology recommends FTPS or SFTP instead. If you use Hyper Backup to a remote destination, select its transfer-encryption option; for Shared Folder Sync, enable SSH transfer encryption.What can I do to enhance the security of my Synology NAS?

Expected result: Fewer unnecessary network services are exposed, and DSM’s security checks can flag issues that need attention. Security Advisor is a review aid, not a replacement for backups.

2. Keep recoverable snapshots where supported

Snapshot Replication

1. Check that the shared folders you want to protect are on Btrfs volumes and that your NAS supports Snapshot Replication. If either requirement is not met, do not assume this feature is available; consult the official Synology ransomware-prevention guidance for model-specific details.

2. In Snapshot Replication, configure regular snapshots for important shared folders and LUNs. Choose a schedule and retention that suit your data and available storage.

3. If the NAS and configuration support it, set a protection period for immutable snapshots. During that period, Synology says the snapshots and their corresponding shared folders or LUNs cannot be deleted.

Snapshot settings and available protections vary. The supplied documentation does not specify one menu path or schedule that applies to every DSM release, so follow the instructions shown for your model rather than relying on a universal click-by-click path.What can I do to enhance the security of my Synology NAS?

WriteOnce shared folders

When creating a shared folder, Synology documents an option named Protect this shared folder with WriteOnce. It prevents files from being modified or deleted according to the selected Enterprise or Compliance mode and retention period. Use this only if the option is available and its retention behavior fits your needs; the source does not provide model-by-model availability or recommend a single mode for everyone.What can I do to enhance the security of my Synology NAS?

Expected result: You have point-in-time protection for supported folders or LUNs, with a defined retention policy. Snapshots alone are not a substitute for a backup stored elsewhere.

3. Make a separate, versioned backup

Use Hyper Backup to back up important data to an off-site Synology NAS or cloud destination, following the 3-2-1 approach: keep multiple copies, use different storage locations or types, and keep one copy off-site. Synology documents backups of folders, system settings, packages, and LUNs to destinations including local volumes, external devices, other Synology systems, rsync servers, and public cloud services. Hyper Backup supports multiple versions and configurable rotation; select a retention policy that preserves versions you may need.Hyper Backup

1. Create a Hyper Backup task for the folders and other supported items you need to protect.

2. Choose a destination separate from the data being backed up, preferably off-site, and configure a schedule and version rotation.

3. For a remote destination, enable transfer encryption where available. If using an encrypted backup, keep its encryption credentials safe; the supplied material does not describe account- or password-recovery options.

4. Confirm that the task completes successfully and that the destination contains a backup you can access. Do not treat an untested task setup as proof of recoverability.

4. Verify and maintain the protection

• Confirm Security Advisor has been run and review any outstanding recommendations.

• Check that snapshot tasks are configured for the intended folders or LUNs, and that immutable protection is active only where supported and configured.

• Check Hyper Backup’s task status and version history. Periodically confirm you can access the backup and follow Synology’s model- and destination-specific restore instructions.

• Recheck protection after changing volumes, shared folders, NAS models, or DSM versions.

Troubleshooting

• Snapshot options are missing: Check whether the NAS supports Snapshot Replication and whether the shared-folder volume uses Btrfs. Shared-folder snapshots require Btrfs; do not assume another file system can use the same feature.What can I do to enhance the security of my Synology NAS?

• Immutable snapshots or WriteOnce are unavailable: Model support, selected mode, or DSM options may differ. Do not assume a setting exists on every device; consult the official Synology guidance and documentation for your NAS.

• A Hyper Backup task fails or has no useful history: Check the task status and destination, then review its schedule and rotation policy. Hyper Backup can automatically remove older versions according to rotation settings, so verify that the configured policy retains the history you intend.Hyper Backup

• You suspect ransomware activity: Avoid deleting snapshots or backup versions. Preserve the available recovery points and consult Synology’s ransomware-prevention guidance for next steps. Before restoring, verify a separate backup of current data to avoid losing files created after the incident.