Ports 80 & 443 open - Security risk?

[#1]

They probably have designed it exactly as a NAS device. But designing a device to be used as NAS is not identical to a designing a device to be used as a public webserver so including one means compromising some design elements, and security will be one.
It's not so much the device that's the problem as how they've marketed it.
Using it as an internal non-public webserver would probably be fine of course. (My webserver is an old compaq desktop the office were getting rid of with the 60GB disk wiped and Linux installed. Zero cost :))

[#2]

Hi Paulh - good point.  QNAP probably threw in the Apache web server function as a selling point, but consumers pay the price of weakened security.   
I, too, had a less-risky standalone web server proposition.  In my case, I had W2K Server / IIS running on an old PIII.  But the whole point of migrating everything to an all-in-one is to reduce power usage, save on space and provide easier management in one place.
I understand the latest beta firmware for the device has introduced web server logging.  So if I upgrade my firmware I can at least monitor web server activity if not be secure against hack attacks.
Unless I risk my personal data, is there anything I can do to make my Web Server / NAS more secure?  Are there any Linux apps that will increase security please?
Thanks
Scott