Many offices buy a NAS, set up RAID, and assume their data is safe. Then a staff member deletes a folder, ransomware encrypts the shares, or the NAS itself fails, and they discover RAID was never a backup. Here is a simple, practical backup plan.
RAID is not a backup
RAID (or Synology SHR) keeps the NAS running when a drive fails. It does not protect you from:
- Accidental deletion or overwriting of files
- Ransomware encrypting files on the NAS
- The NAS itself failing, being stolen, or damaged by fire or water
The 3-2-1 rule
A widely used guideline for backups:
- 3 copies of your data (the original plus two backups)
- 2 different types of storage (for example the NAS and a USB drive, or the NAS and a second NAS)
- 1 copy off-site (another office, or cloud storage)
For a small office this can be as simple as: files on the NAS, a nightly backup to a USB drive or second NAS, and a cloud backup copy.
Snapshots: your first line of defence against ransomware
Snapshots are read-only, point-in-time copies of a shared folder. If ransomware or a user damages files, you can roll back to a snapshot taken before it happened, often in minutes.
- Synology: Snapshot Replication (on supported models and Btrfs volumes)
- QNAP: built-in snapshots (on supported models and volumes)
Schedule snapshots several times a day for important shares, keep them for a few weeks, and where available use immutable snapshots that cannot be deleted for a set period.
Off-site and cloud copies
- Synology: Hyper Backup can copy data to another Synology, a USB drive or cloud storage.
- QNAP: Hybrid Backup Sync (HBS 3) can back up to another NAS, USB or cloud.
Encrypt backup copies and use separate credentials for the backup destination, so an attacker who reaches the NAS cannot also delete the backups.
Back up PCs and servers too
A NAS is also a great backup target for computers. Synology's Active Backup for Business and QNAP's backup tools can back up Windows PCs and servers automatically, so a failed laptop does not mean lost work.
Test your restores
A backup you have never restored is a hope, not a plan. Every month or quarter, restore a few files and, occasionally, a full folder or machine. Check that backup jobs are completing and that alerts reach someone who will act on them.
A simple checklist
- RAID/SHR for drive failures
- Snapshots several times a day for important shares
- Nightly backup to a second device
- Off-site or cloud copy, encrypted
- Email alerts for failed jobs and drive health
- Regular restore tests
Quick answers
Is RAID enough to protect my NAS data? +
No. RAID protects against a drive failure, not deletion, ransomware or losing the whole NAS. You also need snapshots and at least one separate backup copy.
Do snapshots protect against ransomware? +
They help a lot. Snapshots let you roll back to a copy from before the attack. Immutable snapshots, where supported, add more protection because they cannot be deleted for a set time.
How often should I test NAS backups? +
At least every quarter, and ideally monthly for important data. Restore some files and confirm they open correctly.
We design and set up NAS backups that actually restore. Onsite in Delhi NCR, remote anywhere.