What is network attached storage (NAS)?

Network attached storage (NAS) is a dedicated storage device that connects to your network and provides file-level data access to authorized users and client devices. Instead of attaching storage directly to a single machine, NAS makes stored data available to every device on the network through standard file-sharing protocols.

If you manage an Active Directory environment, NAS matters to you specifically because these devices often store sensitive business data, authenticate users through AD, and generate file access events that need auditing for both security and compliance.

How network attached storage works

NAS architecture

A NAS device is a purpose-built appliance with its own operating system, CPU, and RAM. It connects to the network over Ethernet, operates independently from your servers and workstations, and serves files to clients using standard protocols. Most enterprise NAS devices run a specialized OS optimized for file serving, like Synology DiskStation Manager, QNAP QTS, or NetApp ONTAP.

You manage a NAS through a browser-based admin console. From there, you create shared folders, assign access permissions, configure RAID, and set up replication or backup schedules. In AD-managed environments, enterprise NAS devices can join the domain, so users authenticate with their AD credentials and access is governed by NTFS-style permissions.

Network protocols

NAS devices communicate with clients using file-sharing protocols matched to the operating systems in your environment.

SMB/CIFS is the primary protocol in Windows and Active Directory environments. When a NAS device is domain-joined, Windows clients access shares over SMB using their AD credentials. NFS is the standard for Linux and UNIX systems, commonly used in mixed-OS environments and virtualization datastores.

AFP was the legacy macOS file-sharing protocol, though Apple has deprecated it in favor of SMB in recent macOS versions. FTP/SFTP provides remote file transfer access, primarily for external data exchange rather than everyday file sharing.

RAID and redundancy

NAS devices use RAID (Redundant Array of Independent Disks) to protect against drive failure. RAID combines multiple physical drives into a single logical unit, and the RAID level determines how data is distributed and protected.

RAID protects against hardware failure, but it is not a backup. RAID won't save you from ransomware encrypting files across all shares, accidental bulk deletion, or silent data corruption. You still need a separate backup strategy regardless of RAID level.

Can NAS work without internet?

NAS operates on your local network and does not require an internet connection for file storage, sharing, or retrieval. Users on the same LAN can access NAS shares with no internet dependency. You only need internet access if you use remote access features like QuickConnect (Synology), myQNAPcloud (QNAP), or VPN-based access from outside the network.

Common NAS use cases

Organizations deploy NAS for centralized file storage and sharing across departments. Instead of files being scattered across individual workstations, a NAS gives teams a single location to store, retrieve, and collaborate on documents with consistent access controls.

NAS is also a common backup target. You can point workstation backup agents, server backup jobs, and application-level backups at a NAS share, centralizing your backup storage without the cost of a SAN. For organizations that need offsite copies, many NAS devices support NAS-to-NAS replication over a WAN link, turning the remote NAS into an offsite backup target.

Enterprise NAS devices with iSCSI support can serve as virtualization datastores, hosting VM disk files for VMware or Hyper-V environments. This gives smaller organizations SAN-like functionality at a lower cost. NAS is also frequently deployed for disaster recovery, where a replicated NAS at a secondary site holds copies of critical file shares.

NAS vs. DAS vs. SAN

NAS, DAS, and SAN each solve different storage problems. The differences come down to how they connect, what level of storage they provide, and who can access them.

NAS handles file-level workloads like shared drives, home folders, and general document storage. SAN handles block-level workloads that demand low latency, like transactional databases and large-scale VM hosting. The two frequently coexist in enterprise environments.

DAS is the simplest option but is limited to a single host, which makes it impractical for shared access.

Benefits of NAS for enterprise environments

NAS gives you centralized management through a single admin interface. You configure shares, permissions, RAID, and replication from one browser-based console, and every authorized user on the network can access the storage without additional client software.

From a cost standpoint, NAS delivers a lower cost per terabyte than SAN because it uses standard Ethernet networking instead of a dedicated storage fabric. You don't need Fibre Channel switches, HBAs, or specialized cabling. For organizations that need shared storage but can't justify SAN infrastructure costs, NAS fills that gap.

NAS devices include built-in data protection features like RAID, snapshot capabilities, and replication to a secondary NAS or cloud target. Snapshots let you roll back to a point-in-time copy of a file or folder without restoring from backup, which is useful for recovering from accidental deletion or file corruption.

In AD-managed environments, enterprise NAS devices can join the domain directly. You manage access through the same AD groups and NTFS permissions you already use for Windows file servers, and users authenticate with their existing domain credentials.

Limitations and downsides of NAS

NAS shares network bandwidth with all other traffic on the same Ethernet segment, though for general file sharing and backup this is rarely a bottleneck. For latency-sensitive workloads like transactional databases or high-IOPS VM storage, NAS is the wrong tool. Those workloads belong on a SAN or local storage.

A single NAS appliance without replication is a single point of failure. If the device goes offline, every user who depends on those shares loses access. You can mitigate this with NAS-to-NAS replication, a failover-capable NAS cluster, or a tested backup and restore process.

Scaling beyond the drive bay count of a single NAS unit means either adding expansion shelves (if supported) or deploying additional NAS appliances. At a certain scale, the management overhead of multiple standalone NAS devices tips the balance in favor of a SAN or a distributed storage platform.

NAS devices on the network are accessible to any device with valid credentials, which expands the attack surface. If an attacker compromises an AD account, they can access every NAS share that account has permissions for. Without file access monitoring, this kind of lateral movement goes undetected.

NAS security risks and attacks

NAS devices are frequently overlooked in security planning because teams treat them as passive storage rather than active infrastructure. But a NAS appliance centralizes large volumes of files in a single network-accessible location. That makes it a high-value target.

Ransomware targeting NAS shares

NAS devices storing shared files are among the most damaging targets for ransomware. When ransomware executes on a compromised workstation, it can encrypt files across every mapped NAS share that the logged-in user has write access to. A single infected endpoint can encrypt files that hundreds of users depend on.

NAS-specific ransomware has also targeted devices directly. In 2022, the Deadbolt ransomware campaign targeted QNAP NAS devices by exploiting a vulnerability in the Photo Station application. Deadbolt encrypted files on the NAS itself, bypassing endpoint security entirely.

QNAP issued multiple security advisories and firmware patches, but the campaign affected thousands of devices globally.

Unauthorized file access

Weak or default credentials on NAS admin interfaces are a persistent risk. Many NAS devices ship with default administrator accounts, and if those credentials aren't changed during setup, anyone on the network can gain full administrative access.

Overprivileged file share permissions compound the problem. When share permissions are broader than necessary, users can access data well beyond their role. Without auditing, you have no way to know whether someone is accessing files they shouldn't be touching.

Data exfiltration

A compromised AD account can copy sensitive files from NAS shares without triggering any alert if file access monitoring isn't enabled. NAS devices are particularly vulnerable here because they centralize large volumes of data in one location. An attacker with read access to critical shares can quietly exfiltrate documents over days or weeks, and you'd never know.

Lateral movement via NAS

Attackers who compromise a single endpoint can use stolen credentials to access NAS file shares across the network. Domain-joined NAS devices authenticate users through AD, so a compromised domain account grants access to every NAS share where that account holds permissions. NAS shares become a natural target during lateral movement after an initial endpoint compromise.

ADAudit Plus monitors file access, modifications, and permission changes across 14 NAS device types and provides real-time alerts when suspicious activity occurs on NAS shares. That includes an unusual spike in file deletions or access from an unfamiliar client machine.

Limitations of native NAS logging

Built-in NAS logging varies by vendor and falls short of what you actually need for security monitoring and compliance.

Vendor-specific log formats

Each NAS vendor uses its own logging format and admin interface. Synology logs look different from QNAP logs, which look different from NetApp audit trails. If your environment includes NAS devices from multiple vendors, there's no native way to view file access events in a consistent format.

No centralized audit trail

Native logs exist only on the individual NAS device. To correlate file access events across multiple NAS appliances and your Windows file servers, you'd need to manually export logs from each device, normalize the formats, and cross-reference timestamps and usernames. In practice, nobody does this.

No real-time alerts

Native NAS logging records events after they occur but doesn't notify you when something suspicious happens. If a user suddenly deletes hundreds of files from a shared folder (a common ransomware indicator), the events get written to the local log. Nobody gets alerted in real time.

No compliance-ready reporting

Regulatory standards like SOX, HIPAA, PCI-DSS, and GDPR require documented audit trails of who accessed sensitive data and when. Native NAS logs don't map to these standards and can't produce the formatted, schedulable reports that compliance auditors expect. Generating audit-ready output from raw NAS logs requires manual extraction, formatting, and correlation, which is tedious enough that it rarely happens consistently.

Limited retention

NAS log storage is constrained by the device's local storage capacity. Older logs get overwritten as new events accumulate. When you need to investigate a past incident, the relevant logs may already be gone.

Monitoring NAS file access with ADAudit Plus

What ADAudit Plus monitors on NAS devices

ADAudit Plus audits file access activity across 14 NAS device types from a single console: Windows File Server, Windows File Cluster, NetApp Server (7-Mode and C-Mode), EMC Isilon, Hitachi NAS, Huawei OceanStor, EMC Server, Synology NAS, Amazon FSx, QNAP NAS, Azure File Share, CTERA Edge Filers, Nutanix Files, and Qumulo NAS.

For each device type, ADAudit Plus provides pre-configured reports under the File Audit tab. These cover every core file operation:

• File and folder creation, modification, deletion, move, rename, and copy (via the All File or Folder Changes report)
• Successful file reads (via the File Read Access report)
• Folder permission changes with old and new DACL values (via the Folder Permission Changes report)
• Denied access attempts (via the Failed attempt to Read/Write/Delete File reports)

Every report includes the user identity, file path, timestamp, client machine name, and client IP address.

ADAudit Plus also applies user behavior analytics (UBA) to NAS file activity. Machine learning establishes a baseline of normal file behavior for each user, and the system flags deviations. Four UBA reports are directly relevant to NAS security:

• Unusual Volume of File Deletions (a ransomware indicator)
• Unusual Volume of File Activity (a data exfiltration indicator)
• Unusual Volume of File Modification (another ransomware indicator)
• File Activity performed at Unusual Time

Native NAS logging vs. ADAudit Plus

Frequently asked questions