3

I have four pcs connected to a switch connected to a router that gets connected directly to the internet.

How safe is a NAS attached to the same router along with the switch plug?

I'd like to have the NAS available internally but safe from any intrusion (it contains sensitive data).

Edit: it was asked to add more details so here they come: the four pcs all have Windows 7 OSes, they're modern machines, the copies are constantly kept up-to-date with OS updates. We only use Microsoft security essentials and no additional antivirus/firewalls to keep them light. The Router is a Netgear (can't exactly remember which model) with wi-fi capabilities (and the wi-fi is usually enabled, pcs don't use it though, nor does the NAS in any way).

  • Please add a bit about how you define safe. As it stands now, this question is quite open-ended... – Matthew Peters Jan 8 '15 at 21:31
  • Sure, the last thing I want is someone to hack into the NAS. If that cannot/is unlikely to happen, I can define my configuration "safe". – user3834459 Jan 8 '15 at 21:46
  • Internet sites can attack internal IP ranges through things like your browser, see BeEEF. – wireghoul Jan 8 '15 at 21:51
  • Be sure your WiFi is using WPA2 with a non-trivial key, or turn it off completely. If the WiFi is unsecure, the NAS is accessible that way. – Bob Brown Jan 9 '15 at 0:14
5

If the NAS isn't directly accessible from the internet then the PCs are the weakest link.

An attack would focus on the PC. Then, with access to the PC, getting access to the NAS would be easy.

Attacking the PC first is easier, because - They make connections to the internet regularly. Web browsing and e-mail make good routes for an attacker. - They are more complicated than the NAS, which often means more vulnerabilities.

Together this makes them much easier to hack than attacking the NAS directly.

If you have good security on the PCs (avoid dodgy sites, install good host security software and keep them patched ... ) then you are probably in reasonably shape for a small office or domestic situation.

And, I think obviously, as suggested in the comments. Disable the Wi-Fi if you don't use it.

I'm also assuming that:

  • You are only worried about remote intrusion. You trust the people who use the computers and who have physical access to the system.
  • You aren't worried about, or have taken steps to reduce the chance of, the NAS just being stolen. Old fashioned theft.
  • The router is configured securely (and kept up to date with security patches as well). And by configured securely that I mean it provides NAT and you haven't enabled any risky features like the 'DMZ' or 'port forwarding' options that cheap routers merrily provide. It also doesn't have remote administration enabled from the public internet IP address.

Could you get an intrusion?

So, you've taken steps to reduce the risk. Running AV, using modern systems and keeping them patched goes a long way.

But an attack is possible. Despite layers and layers of additional security, companies with systems connected to the internet get hacked frequently.

How could this happen?

You can divide the remote attacks into two categories.

  • Targeted attacks - where someone is specifically targeting your data.
  • Un-targeted attacks - where someone is trying to hack a bunch of computers, and by chance your computer is on their list.

Targeted Attack

Target attacks are expensive and/or time consuming activities for an attacker.

They might need to write a new virus, one that isn't detected by the Microsoft AV. Then they could send it to you, via e-mail or perhaps a link to a web page.

It might need someone to click on the link, or perhaps they need to use a new vulnerability which hasn't had a security patch released yet. These are known as zero day vulnerabilities.

But these are expensive activities. New vulnerabilities are valuable to attackers. And writing viruses that bypass AV checks takes a little effort. So you have to be a target that they knew about and were interested in.

From an article about attacks:

Of the 18 attacks studied, 15 targeted 102 or fewer of the 11 millions hosts that were monitored. Eight of the exploits were directed at three or fewer hosts. The data confirms conventional wisdom that zero-day attacks are typically reserved for high-value targets.

(Full article: http://arstechnica.com/security/2012/10/zero-day-attacks-are-meaner-and-more-plentiful-than-thought/)

Un-targeted attacks

There's also the possibility that you get hit by a brand new attack, where you are just one of thousands of possible targets, using new vulnerabilities and/or viruses. You'd be unlucky but it happens - but it does happen.

Though often they are just after quick financial wins - perhaps the password to your bank - or to encrypt your hard drive and demand a ransom for your data. Not every hack of this kind would result in them being interested in whatever is on your NAS.

So how safe are you?

It depends on how interesting your data is, and whether possible attackers know about it, as to whether a targeted attack is likely. Perhaps you have some feel for this already.

I'm sure there are some stats on untarget attacks on the internet somewhere. I'll have a look for some figures.

What should you do?

Perhaps another interesting question is what else could you do if you want to be more secure. The resulting advice could form a reasonably long book.

The simplest solution: if the data is really really sensitive, don't connect it to the Internet. Don't access it from a computer that can access the Internet.

The practical alternative for the non-professional: Or, if you need the flexibility of connecting to the Internet, but still want real confidence about the security, get some security experts in, explain the level of security you need and have a detailed review done. It's not cheap though - and you need to ensure you are getting good advice!

  • Thanks, I added some relevant information to be more precise. – user3834459 Jan 8 '15 at 22:36
0

You should be able to prevent the NAS from accessing/being accessed by the WAN side of the router, and therefore only accessible to LAN hosts.

It should actually be configured this way by default, unless you have specifically enabled port forwarding on the router

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.