Organizations have long used network attached storage (NAS) appliances as backup targets because they provide familiar, flexible, and accessible storage. However, ransomware and rapid backup growth now force organizations to demand more from the NAS systems protecting their backup data. These requirements increasingly include immutability, cyber resilience, high-speed recovery, greater capacity, and tighter backup software integration.
To help organizations identify these systems, DCIG has begun researching cyber resilient NAS appliances that providers specifically position as backup targets. DCIG requires these appliances to support NFS or SMB and minimally two core cyber-resilience capabilities, among other requirements. While DCIG continues to research this topic, these five early insights stand out from the NAS appliances already evaluated.
Insight #1: NAS Backup Targets Now Span HDD, Hybrid, and All-Flash Architectures
Organizations no longer need to assume that using NAS systems as backup targets means purchasing an HDD-based system optimized primarily for capacity. DCIG identified appliances ranging from HDD-heavy and hybrid systems to products designed entirely around flash media and high-performance scale-out architectures. This diversity gives organizations substantial latitude to match backup storage performance, capacity, density, and cost with their requirements.
The differences can become substantial even among products that address similar backup requirements and present storage using the same file protocols. For example, some solutions support both HDD and all-flash configurations, while others exclusively use flash for capacity. Organizations should consequently evaluate NAS backup targets according to their specific backup and recovery workloads and not as one category.
Capacity also extends well into territory once associated primarily with high-end enterprise storage systems used for backup. Configurations often reach multiple petabytes that make many general-purpose NAS appliances viable for large enterprise backup repositories.
Insight #2: Immutability Becoming a Standard NAS Backup Requirement
A NAS appliance positioned as backup targets can no longer rely solely upon RAID, snapshots, replication, and traditional storage availability features. Ransomware increasingly makes preventing unauthorized modifications or deletions of backup data essential components of any backup target. DCIG’s early research finds providers responding by incorporating immutable snapshots, snapshot locking, retention controls, and other preservation mechanisms.
The implementation varies considerably. These variations make examining exactly how each provider delivers immutability important when organizations compare these NAS backup targets. For instance, they may offer data retention management, immutable file systems (think WORM), immutable snapshots, and snapshot locking capabilities. These technologies can prevent attackers possessing ordinary storage credentials from simply deleting protected recovery points.
Organizations should also not assume every feature labeled “immutable” provides equivalent protection against ransomware or malicious administrators with elevated privileges. They should examine who can create, modify, shorten, or delete retention policies and what administrative safeguards protect these capabilities. Organizations should also determine whether compromising the NAS administrative interface could compromise the immutable backup copies stored on the appliance.
Insight #3: Cyber Resilience Extends Well Beyond Immutability
DCIG’s inclusion criteria also examine anomaly or ransomware detection, encryption, and identity and access management alongside data immutability and preservation. These features recognize attackers may target the NAS storage system itself after compromising production systems and backup software.
DCIG’s research already identifies meaningful differences in how deeply individual providers implement these capabilities and how well they document them. In addition to immutability, NAS appliances often offer:
- Anomaly detection;
- Directory integration;
- Encryption;
- Multi-factor authentication (MFA);
- Ransomware detection;
- Role-based access controls (RBAC) and administration;
- Secure audit logging.
Others provide strong data-preservation capabilities while offering fewer publicly documented options for detecting suspicious file activity or administrative behavior.
These differences matter because organizations increasingly need backup targets that helps them prevent, detect, withstand, and recover from successful cyberattacks. A NAS appliance’s value as a backup target increasingly depends upon its security architecture rather than simply capacity and throughput. Organizations should particularly examine whether security features operate independently of the backup software and remain effective following compromised administrative credentials.
Insight #4: Backup Application Integration Varies More Than Expected
General-purpose NAS appliances possess one inherent advantage as backup targets: enterprise backup applications already know how to write to them. By using standard NFS or SMB shares, these appliances avoid requiring proprietary protocols to transmit and retain backup data. DCIG’s evaluation criteria specifically require qualifying NAS appliances to present shares or folders using NFS or SMB.
That compatibility does not mean every NAS appliance integrates equally well or offers certifications with every backup application. Some providers explicitly document certifications, integrations, or support for specific backup software. In other cases, they publicly document backup use cases or integrations with backup software.
Organizations should distinguish between an application simply writing backups to an NFS or SMB share and tested or certified integration. Certification may provide greater assurance concerning configuration, performance, supportability, immutability, and recovery workflows when using a specific backup application. This distinction becomes increasingly important as organizations depend upon the NAS appliance for both routine recoveries and ransomware recovery operations.
Insight #5: NAS and Object Backup Targets Converging
Finally, DCIG found a growing overlap between NAS file storage and S3-compatible object storage on these appliances. Multiple products can present NFS and SMB storage while simultaneously offering an S3-compatible object interface from the same platform.
This convergence potentially lets organizations consolidate different backup repositories onto one storage platform. However, merely exposing an S3-compatible endpoint does not mean a NAS appliance implements every Amazon S3 API capability. DCIG consequently evaluates S3 capabilities separately even though its NAS-focused reports primarily emphasize file protocol functionality.
This distinction becomes important as backup applications expand their support for on-premises S3-compatible storage and S3 Object Lock for immutability. Some surveyed appliances already expose capabilities such as Object Lock, multipart uploads, parallel operations, expiration policies, and other object-storage functionality. Organizations may therefore consider using one appliance to satisfy both their NAS and object backup target requirements.
General-Purpose NAS Appliances Emerge as Serious Backup Targets
DCIG’s early research indicates organizations should not view all general-purpose NAS appliances used as backup targets as equivalents. Many offer all-flash configurations, encryption, identity controls, immutability, petabyte-scale capacity, ransomware detection, replication, and S3-compatible object storage. These capabilities position some NAS appliances to compete directly with purpose-built backup appliances for specific enterprise backup workloads.
However, significant differences between these systems exist in their architecture, backup integration, cyber resilience, performance, and scalability. Organizations should therefore evaluate these appliances according to how well they complement their existing backup infrastructure. DCIG’s forthcoming Cyber Resilient General Purpose Backup Appliance TOP 5 reports will help organizations make those distinctions.
KEEP UP TO DATE WITH DCIG
To be notified of new DCIG articles, reports, and webinars, sign up for DCIG’s free weekly Newsletter.
To learn about DCIG’s future research and publications, see the DCIG Editorial Calendar.
Technology providers interested in licensing DCIG TOP 5 reports or having DCIG produce custom reports on their behalf, please contact DCIG for more information.