Security of DSM 6 vs. DSM 7?

[giorgitd]

What are the risks of using an older DS NAS that is unable to support DSM 7 and is stuck on DSM 6? Or DSM 5?! Or earlier DSM versions? I am running two DS218+ devices (DSM 7), learning a lot and they are performing great. Super happy with my upgrade from a DS110j! But I'm interested in a 'sandbox' device that I would just use for fun - but I don't want to expose my network to undue risk if it is so old that it can not support the current DSM. I mean, I can change the default ports, turn off most of the susceptible services. But, fundamentally, how much more risky is DSM 6 vs DSM 7? What about even earlier versions of DSM? Is there a 'breakpoint' below which it is inadvisable to go? I know that a DSx12 (let's say) is less capable, performance wise, than a DSx23. But what if I don't care much about performance? If that DSx12 is limited to DSM 6.2.4, what risks do I assume relative to a DSM 7 device?

 

[akahan]

I would think you'd be fine...for now. DSM 6.2 still gets security updates, and will continue to do so through October of 2024. So you've got a couple good months left! After that, Synology can be expected to stop patching new security issues as they arise.

 

[Rusty]

Also, picking up what @akahan said, your x18 device supports up to DSM 7.1.1. that atm is the latest version before 7.2. So in other words you are not falling behind for that unit at all, especially from a security standpoint.

 

[giorgitd]

Yes, agree with all of this, but what I am suggesting is getting a used DSx12 (or even older model) and using it for fun for the next few years. So, if DSM 6 is still getting security updates, for the sake of this discussion, let's say that I'd be running a device limited to DSM 5. Security risks? I'm looking for: don't do it - certain disaster to probably ok, but... to nearly as fine as DSM 7. Where in that range is a depreciated DSM that is no longer receiving security patches?

 

[Birdy]

Synology Software LifeCycle Policy

 

[ChAlb]

Devices stuck with 7.1.1 did not received any security updates since 14 months despite known unpatched vulnerabilities… So it’s a bit hard to consider 7.1 as “secure” and supported by Synology in terms of security…

 

[akahan]

Nobody can answer your question but you. "How much security do I need" is a function of how important and sensitive is the information potentially accessible through the NAS. If the machine is going to contain, or be connected to a network that contains, anything you care about, then you'd be foolish to use a machine that is not getting prompt security updates. If you're using it "for fun," and it won't be connected to a network with anything you care about, then who cares?

 

[Telos]

Unless you are a high value target, it's unlikely any of these "security" patches will change your life.