How to Secure NAS-to-Cloud Data Transfers

Secure a NAS-to-cloud transfer by using an encrypted provider connection, enabling two-factor authentication on both accounts, limiting the integration’s permissions, and verifying that uploaded files can be recovered.

If you have not created the transfer task yet, first follow our guide to setting up an automated UGREEN NAS cloud backup.

NAS-to-cloud transfer risks at a glance

These controls address different threats. Do not treat one of them as a replacement for the others. For protection of the NAS itself, including accounts, permissions, firewall settings, updates, and encrypted Vault storage, see our guide to UGREEN NAS encryption and security controls.

How does TLS protect a NAS-to-cloud transfer?

TLS encrypts the network connection and helps authenticate the service at the other end. It protects data in transit against interception and modification when the connection and certificate validation operate correctly. NIST’s TLS guidance explains these transport-security functions in more detail.

TLS does not encrypt the file independently of the connection. After the provider receives the file, the provider’s at-rest encryption and access policies determine how that stored copy is protected.

This distinction matters because “encrypted during transfer” and “only I can decrypt the cloud copy” are different claims. The second requires client-side encryption with a key that the cloud provider does not possess.

Before starting a transfer:

1. Update UGOS Pro and the Cloud Drives application.
2. Connect through the provider’s official authorization flow or API endpoint.
3. Confirm the NAS has the correct date and time, since an incorrect system clock can cause certificate-validation errors.
4. Do not bypass unexpected certificate warnings or redirect the connection through an untrusted proxy.
5. Stop and investigate if the provider login page uses an unfamiliar domain.

How should you secure Cloud Drives credentials?

Google Drive, Microsoft OneDrive, and Dropbox use a provider authorization flow. Cloud Drives receives an access token after authorization instead of storing the cloud account password.

Amazon S3 and Backblaze B2 use key-based credentials:

• Amazon S3 requires an Access Key ID and Secret Access Key.
• Backblaze B2 requires a Key ID and Application Key.

Treat every token and key as a password. Anyone who obtains a valid credential can act within the permissions granted to it, often without entering the account password or completing MFA again.

Enable MFA on the cloud account

MFA makes an interactive account takeover more difficult. Enable it on Google, Microsoft, Dropbox, AWS, Backblaze, or any other account connected to the NAS.

MFA does not neutralize a token that has already been issued. If a token or key is exposed, revoke it through the provider and create a new connection.

Limit the authorized permissions

Grant only the access needed for the transfer.

For OAuth connections, review the permissions shown on the provider’s authorization screen. Do not approve unrelated account or administrative access.

For Amazon S3, use credentials restricted to the required bucket or path where possible. Do not use AWS root-account access keys.

For Backblaze B2, create a dedicated application key and limit it to the intended bucket when the workflow allows it.

Using a separate credential for the NAS makes revocation easier and prevents one exposed key from affecting unrelated cloud resources.

Remove credentials before servicing or disposing of the NAS

Our UGREEN NAS Privacy Policy states that access tokens for connected third-party cloud services are stored locally on the NAS, with retention periods varying by provider.

Before servicing, selling, transferring, or disposing of the NAS:

1. Delete each connection from Cloud Drives.
2. Revoke the OAuth authorization through the cloud provider.
3. Deactivate or delete S3 access keys and B2 application keys.
4. Confirm that scheduled transfers can no longer reach the cloud destination.
5. Create new credentials if the connection will be moved to another NAS.

Deleting only the Cloud Drives connection does not prove that the provider-side credential has been invalidated. Complete both sides of the process.

What if the NAS itself is compromised?

A secure password and TLS connection do not protect the cloud copy from malware already running on the NAS. Malware can use an authorized Cloud Drives connection within the permissions granted to its token or key.

Cloud Drives is a synchronization tool. A synchronized copy becomes a dependable recovery copy only when deleted or overwritten versions remain recoverable.

Protect important cloud destinations with one or more of these controls:

• File version history
• Deleted-file retention
• S3 Versioning
• Backblaze B2 file versions
• Object Lock or another provider-supported immutability feature
• A separate credential that cannot delete protected recovery versions

Object Lock can prevent protected objects from being deleted or overwritten during the configured retention period. It is especially valuable when a compromised NAS still has permission to modify the normal cloud destination.

When should you encrypt files before uploading them?

Use client-side encryption when the cloud provider, a compromised cloud account, or someone with provider-side storage access must not be able to read the files.

The encryption happens before the file leaves the NAS. The cloud receives ciphertext and does not possess the key needed to recover the original content.

This approach fits:

• Financial and tax records
• Identity documents
• Legal or contractual files
• Confidential business data
• Private archives stored with a third-party provider

Cloud Drives does not encrypt files before uploading them. Client-side encryption requires a backup application that provides it: Duplicati, Kopia, and restic all encrypt before upload, and rclone offers it through a crypt remote. All of these run as Docker containers, so they are unavailable on models without Docker support, including the DH2300.

Secure NAS-to-cloud transfer checklist