If the NAS isn't directly accessible from the internet then the PCs are the weakest link.
An attack would focus on the PC. Then, with access to the PC, getting access to the NAS would be easy.
Attacking the PC first is easier, because
- They make connections to the internet regularly. Web browsing and e-mail make good routes for an attacker.
- They are more complicated than the NAS, which often means more vulnerabilities.
Together this makes them much easier to hack than attacking the NAS directly.
If you have good security on the PCs (avoid dodgy sites, install good host security software and keep them patched ... ) then you are probably in reasonably shape for a small office or domestic situation.
And, I think obviously, as suggested in the comments. Disable the Wi-Fi if you don't use it.
I'm also assuming that:
- You are only worried about remote intrusion. You trust the people who use the computers and who have physical access to the system.
- You aren't worried about, or have taken steps to reduce the chance of, the NAS just being stolen. Old fashioned theft.
- The router is configured securely (and kept up to date with security patches as well). And by configured securely that I mean it provides NAT and you haven't enabled any risky features like the 'DMZ' or 'port forwarding' options that cheap routers merrily provide. It also doesn't have remote administration enabled from the public internet IP address.
Could you get an intrusion?
So, you've taken steps to reduce the risk. Running AV, using modern systems and keeping them patched goes a long way.
But an attack is possible. Despite layers and layers of additional security, companies with systems connected to the internet get hacked frequently.
How could this happen?
You can divide the remote attacks into two categories.
- Targeted attacks - where someone is specifically targeting your data.
- Un-targeted attacks - where someone is trying to hack a bunch of computers, and by chance your computer is on their list.
Targeted Attack
Target attacks are expensive and/or time consuming activities for an attacker.
They might need to write a new virus, one that isn't detected by the Microsoft AV. Then they could send it to you, via e-mail or perhaps a link to a web page.
It might need someone to click on the link, or perhaps they need to use a new vulnerability which hasn't had a security patch released yet. These are known as zero day
vulnerabilities.
But these are expensive activities. New vulnerabilities are valuable to attackers. And writing viruses that bypass AV checks takes a little effort. So you have to be a target that they knew about and were interested in.
From an article about attacks:
Of the 18 attacks studied, 15 targeted 102 or fewer of the 11 millions
hosts that were monitored. Eight of the exploits were directed at
three or fewer hosts. The data confirms conventional wisdom that
zero-day attacks are typically reserved for high-value targets.
(Full article: http://arstechnica.com/security/2012/10/zero-day-attacks-are-meaner-and-more-plentiful-than-thought/)
Un-targeted attacks
There's also the possibility that you get hit by a brand new attack, where you are just one of thousands of possible targets, using new vulnerabilities and/or viruses. You'd be unlucky but it happens - but it does happen.
Though often they are just after quick financial wins - perhaps the password to your bank - or to encrypt your hard drive and demand a ransom for your data. Not every hack of this kind would result in them being interested in whatever is on your NAS.
So how safe are you?
It depends on how interesting your data is, and whether possible attackers know about it, as to whether a targeted attack is likely. Perhaps you have some feel for this already.
I'm sure there are some stats on untarget attacks on the internet somewhere. I'll have a look for some figures.
What should you do?
Perhaps another interesting question is what else could you do if you want to be more secure. The resulting advice could form a reasonably long book.
The simplest solution: if the data is really really sensitive, don't connect it to the Internet. Don't access it from a computer that can access the Internet.
The practical alternative for the non-professional: Or, if you need the flexibility of connecting to the Internet, but still want real confidence about the security, get some security experts in, explain the level of security you need and have a detailed review done. It's not cheap though - and you need to ensure you are getting good advice!
