A NAS — network attached storage — is a small box with hard drives in it that sits on your home network. Every device in the house can reach it without anything being plugged in.
It's genuinely useful and it's frequently oversold. Here's how to decide whether you need one, and how to set one up properly if you do.
Do you actually need one?
A NAS makes sense if:
- Several people or devices need the same files
- You have enough data that cloud subscriptions are getting expensive
- You want backups from multiple computers going to one place
- You have a media library the whole household uses
- You're uncomfortable with cloud storage for some material
- You want fast local access to large files
A NAS doesn't make sense if:
- One person with one laptop — an external drive is cheaper and simpler
- You mainly need off-site protection — a NAS is in your house
- You want zero maintenance — this is a computer you now administer
- Your data comfortably fits in a cloud plan you're happy with
The honest summary: a NAS is a convenience and capacity solution. It is not primarily a protection solution, despite how it's often marketed.
The mistake that matters most
A NAS is not a backup.
RAID — the redundancy feature — protects against a single drive failing. It does not protect against:
- Fire, flood, or theft, because it's one device in one building
- Accidental deletion, which propagates instantly
- Ransomware, which reaches any network location your computer can write to
- The NAS itself failing — the enclosure, the power supply, the controller
- A configuration mistake wiping the array
RAID is uptime, not backup. It means a drive can die without you losing access. That's valuable and it's a different thing entirely.
Every NAS needs its own backup: to the cloud, or to an external drive rotated off-site, or both. A NAS holding the only copy of your family photos is a single point of failure wearing a reassuring disguise.
Choosing one
Number of drive bays. Two is the practical minimum, because one bay gives you no redundancy at all. Four is the sweet spot for most households — it allows redundancy plus room to expand.
Pre-built or DIY. Pre-built units from the established manufacturers come with an operating system, apps, mobile access, and support. They're the right choice for most people. Building your own gives more control and costs more time.
Processor and memory. Basic file storage needs very little. If you plan to run media streaming with transcoding, photo recognition, virtual machines, or containers, buy more than you think — this is the specification people regret.
Drives are bought separately in most cases. Budget for them.
Noise and heat matter if it lives in a room you use. Spinning drives are audible.
Choosing drives
Buy drives designed for NAS use. They're rated for continuous operation and for the vibration of multiple drives in one enclosure. The premium over desktop drives is modest and worth it.
Size: work out your current data, double it, and buy that. Expanding later is possible and disruptive.
Don't buy all drives from the same batch. Correlated failures are real — drives manufactured together can fail together. Buy from different retailers, or a few weeks apart, or mix models.
Check the manufacturer's compatibility list for your NAS model before buying.
RAID, without the jargon
RAID combines multiple drives into one logical volume. The common configurations:
RAID 1 (mirror) — two drives holding identical data. Either can fail without loss. You get the capacity of one drive from two. Simple and safe.
RAID 5 — three or more drives, with one drive's worth of capacity given to parity. Any single drive can fail. Good capacity efficiency.
RAID 6 — like RAID 5 but survives two simultaneous drive failures. Recommended for larger arrays, because rebuilding a big array after a failure takes a long time and stresses the remaining drives, and a second failure during a rebuild is a real risk.
RAID 0 — striping with no redundancy. Faster, and if any drive fails you lose everything. Avoid.
Manufacturer hybrid modes — most NAS vendors offer their own flexible scheme that allows mixed drive sizes and easy expansion. For most home users these are a good default.
Choose: RAID 1 for two bays, RAID 5 or the vendor's hybrid equivalent for four, RAID 6 for six or more.
The setup order
1. Physical setup. Install the drives, connect power and network. Use a wired ethernet connection — a NAS on wifi is slow and unreliable.
2. Initial configuration. The manufacturer's setup wizard will find the device and walk you through it.
3. Change the default admin credentials immediately. Default logins on network devices are a well-known attack route.
4. Create the storage pool and volume with your chosen RAID level. Initial parity building takes hours to days depending on capacity; you can use it while it runs.
5. Create user accounts — one per person, not a shared login. Individual accounts mean individual permissions and an audit trail.
6. Create shared folders with a clear structure:
Family/ — shared household material
Media/ — films, music, photos everyone uses
Backups/ — computer backups, one folder per machine
[Person]/ — private space per person
Archive/ — finished material, read-only7. Set permissions. Read-only where possible. The archive folder should be read-only for everyone who doesn't need to change it — this is the cheapest protection against accidental deletion there is.
8. Turn on snapshots, if your NAS supports them. Snapshots are periodic read-only point-in-time copies you can browse and restore from. They're excellent against accidental deletion and against ransomware, because a properly configured snapshot can't be altered from the network.
9. Set up notifications so the NAS emails you when a drive fails, a backup fails, or the array degrades. Without this you find out when the second drive dies.
10. Configure the backup of the NAS itself. To a cloud backup service, or to an external drive you rotate off-site. This step is the one people skip and the one that matters.
Security, which people neglect
A NAS is a computer on your network holding everything you own. Treat it accordingly.
- Change the default admin account name and password
- Don't expose it directly to the internet. If you need remote access, use a VPN or the manufacturer's secured remote access service, not port forwarding.
- Enable two-factor authentication on the admin account
- Keep the firmware updated. NAS vulnerabilities are actively exploited, and there have been significant ransomware campaigns specifically targeting internet-exposed NAS devices.
- Turn off services you don't use — every enabled protocol is exposed surface
- Enable the firewall and automatic blocking of repeated failed logins
- Consider encrypting shared folders holding sensitive material
The internet-exposure point is the important one. The large majority of NAS compromises involve devices reachable from the internet with weak credentials or unpatched firmware.
Ongoing maintenance
Monthly: check the dashboard for drive health warnings and confirm backups are running.
Quarterly: verify the backup of the NAS by restoring something from it.
Annually: check drive ages and plan replacements. Drives over four or five years old should be replaced proactively, one at a time, allowing the array to rebuild between each.
When a drive fails: replace it promptly. A degraded array has no redundancy, and the rebuild stresses the remaining drives. Keep a spare drive on hand if the data matters.
Realistic expectations
Speed is limited by your network. A wired gigabit connection gives you roughly 100 MB/s, which is fine for documents and streaming and slower than a directly-attached drive for large file work.
Cost is the box plus the drives plus eventual replacements. It's cheaper than cloud storage over several years for large volumes, and it isn't free.
Effort is real. This is a device you maintain, update, and eventually repair.
It is not off-site. Worth saying a third time.
The minimum viable setup
If you're doing this:
- Two- or four-bay unit, NAS-rated drives, RAID 1 or vendor hybrid
- Wired connection, admin credentials changed, two-factor on, not internet-exposed
- Folder structure with per-person accounts and a read-only archive
- Snapshots enabled
- Notifications configured
- A backup of the NAS to somewhere off-site
Item six is what turns a convenient box into part of a real storage system.
Next in this series: How to Speed Up a Slow Computer by Cleaning Up Files