Network Attached Storage

A subject can write to a Network Attached Storage (NAS) device outside the organization’s control. In remote or hybrid settings, the subject’s ability to access NAS devices on their personal LAN — from a corporate-managed endpoint — introduces a persistent and often unmonitored risk vector.

These consumer-grade platforms (e.g., Synology, QNAP, WD My Cloud) fall outside the scope of organizational governance, yet remain fully accessible when the subject is working from home. If reachable, they provide a standing means to stage, duplicate, or transfer sensitive enterprise data.

This capability is particularly dangerous when VPN configurations permit split tunneling, unintentionally allowing local subnet access alongside corporate resources. Even in the absence of deliberate misuse, the continued accessibility of these unmanaged file-sharing services expands the subject’s technical means and circumvention potential.