TrueNAS
TrueNAS is the World's #1 Open Source Storage. Based on OpenZFS, it is trusted by millions and deployed worldwide.
www.truenas.com
Runs on almost any x86 hardware or you repurpose an OEM x86 NAS or buy an appliance from them.
Just look at the relative CVEs
TrueNAS
Stay away from QNAP. Their security is atrocious.
WD is not much better.
Synology is not far behind
Netgear is not good either
I will say this about some of the CVEs. Disclaimer: I'm a Linux sysadmin, DBA, and ISO. Have been for 28 years.
There is
mitigation, and there is
remediation, and those two are distinct and completely different when it comes to a NAS, and how that NAS is being used.
With the CVEs listed, especially those related to Synology, I know for a fact that the developers that work for Synology are on it when it comes to any vulnerability. In fact, they would already have the patch to the OS or the application available before the CVE is even announced, which is a good thing. We
remediate those vulnerabilities with the patches they provide. That's all fine and dandy, but it should be stressed that having fewer CVEs listed does not mean that the NAS solution being used is more secure than another.. in fact, one could argue the exact opposite.
But that brings in a different issue at the user level, or with how the NAS is used.
A NAS is exactly that: Network Attached Storage. It can go onto a given network and be used throughout that network. But with some of the applications on it, one can use it as their own Cloud server, webserver, music streaming server, video server, etc. However, doing that to remote locations or having remote access to a NAS is its own gift and curse, because exposing the NAS to the Internet is what generates the problems that are indicated in the CVEs. All of that could be
mitigated by not exposing the NAS to the Internet. I get it; different strokes for different folks.. Each person's usage is going to be different, but people also need to take into account what risks they may have with what they are trying to do. For home? If you're not exposing your NAS to the Internet, you're in good shape, as no remote user can get to your NAS without having access to your entire network first. If they already have access to your network, that is a different (a network security) issue altogether, and not the fault of any vulnerability on the NAS.
So for home use, you
mitigate and
remediate. Patch the bugs, and make sure that only then necessary access to the NAS is needed. For example, if your NAS can run SSH, turn it on, move that SSH access to a non-standard port on the NAS, open a port on your router (also non-standard port), NAT that together, and you're set.
If you keep up on things as well as secure it, you're good to go.
BL.