Published on October 29, 2026 · The mitza.es team
In many offices, files live on somebody's computer, on an external drive or scattered across emails and cloud folders. When that gets complicated, the NAS appears: a device with hard drives connected to your network that every computer accesses as if it were a shared folder. It's one of the most popular solutions for small businesses, but also one of the worst understood: it isn't a backup, it isn't a full server and it shouldn't be left open to the internet. This guide tells you what it is and how to use it properly.
What a NAS is (NAS server)
NAS stands for Network Attached Storage. It's a small computer specialized in storing and sharing files: it holds one or more hard drives (or SSDs) and an operating system of its own, and connects by cable to the router or switch of your local network. It's sometimes called a “NAS server” or “file server” because it provides that service, although it isn't a general-purpose server like those that run management programs or a database.
How it works
The drives are placed in bays and the NAS manages them with its own software (manufacturers such as Synology, QNAP, Asustor or TerraMaster each have theirs). From there you create shared folders, define which user can read or edit each one and access them from the office computers, with a computer or a phone. If configured, it also allows access from outside the office (although, as we'll see, it should be done carefully).
What it's for in a small business
- Shared files for the whole team, with permissions per person or per department.
- Backup destination for the office computers.
- Working with heavy files (design, video, plans, photography) at local network speed, something the cloud doesn't always match.
- Your own Dropbox-style sync, with no monthly fee per user.
- Other uses depending on the model: VPN access server, video surveillance storage or lightweight applications.
NAS, server and cloud: how they differ
- NAS: storage in your office, with your hardware and your maintenance. A one-off payment for the unit and drives, and full control over where the data is.
- Server: a computer (physical or virtual) that, besides files, runs applications: the invoicing program, a database, email… You'll find the general explanation in our guide to cloud computing for small businesses.
- Cloud: storage sits in a provider's data center and you pay a fee. It's convenient for working from anywhere. We compare it in detail in cloud storage for business.
RAID: what it is and what it isn't
RAID combines several drives so the system keeps working if one fails. The most common configurations in an office NAS:
- RAID 1 (mirror): two drives with the same content; if one fails, the other keeps going.
- RAID 5: minimum three drives; it tolerates the failure of one and makes better use of the space.
- RAID 6: minimum four drives; it tolerates two failing at the same time.
- RAID 0: splits the data across drives for speed, but has no protection at all: if one drive fails, everything is lost.
And here's the most important point: RAID is not a backup. It protects against the failure of a drive, not against a file deleted by mistake, a virus that encrypts everything, a theft, a fire or a power surge. For that you need independent copies; the benchmark is the 3-2-1 backup rule.
NAS security: what must not be missing
A NAS holds all your files, so it's an attractive target. Ransomware campaigns aimed specifically at NAS devices exposed to the internet have come to light (for example, the ones that hit QNAP units). The basic measures:
- Don't expose it directly to the internet (don't open ports on the router). For remote access, use a VPN.
- Update the system and the applications regularly, and turn on automatic security updates.
- Change the default administrator account and use long, unique passwords: our password generator can help.
- Turn on two-step verification on the accounts with administration access.
- Use snapshots and, if your model allows it, make them immutable so you can roll back after an attack.
- Keep a copy outside the NAS and outside the office (another disconnected drive or a cloud service).
- Protect the network with a good firewall: we explain it in what a firewall is.
- Disable the services you don't use (default remote access, UPnP, old protocols).
If you're interested in the context of this type of attack, read our analysis of ransomware in Spanish businesses.
Advantages and drawbacks of a NAS
Advantages: full control of the data, speed on the local network, no per-user fees, a lot of capacity for little money and flexibility of use.
Drawbacks: it has to be maintained (updates, drives that get replaced), it depends on your office (theft, fire, power failure), remote access has to be set up properly and scaling capacity means replacing or adding drives.
When a NAS pays off and when the cloud does
- A NAS pays off if you handle large files, want to control where the data is and have someone (or a maintenance service) to look after it.
- The cloud pays off if the team works from several places, you don't want to maintain hardware or you already pay for a suite such as Google Workspace or Microsoft 365.
- A mixed model is usually the most sensible: a NAS for everyday work with heavy files and an encrypted cloud copy as a backup.
What to look at before buying a NAS
- Work out the capacity you use today and multiply it by two or three for the coming years.
- Choose the number of bays: with two you can do RAID 1; with four, RAID 5 or 6 and more headroom.
- Use NAS-rated drives, which are built to run continuously.
- Check the network connection of the unit and of your office; with heavy files, a network bottleneck cancels out the improvement.
- Consider a UPS (uninterruptible power supply) to prevent damage to the drives during power cuts.
- Think about where you'll put it: ventilated, protected from dust and with restricted access.
- Define the external copy from the start, and who is responsible for maintaining it.
Common mistakes with NAS devices
- Thinking that RAID replaces the backup.
- Opening ports on the router to access from outside.
- Never updating the firmware.
- Leaving the default administrator password, or sharing it among several people.
- Buying drives of different ranges and from the same batch with no replacement plan.
- Never testing the restoration of a backup.
How we can help at Mitza
We help you choose, install and secure a NAS (or decide that you don't need one) and get your backups working. If you're in southern Madrid, see our IT maintenance and the computer repair service, or tell us about your case on the contact page.