How does one lock down their Synology? I sadly don't have extensive experience with linux.
These are just best practices, since we don't know anything about this particular piece of malware yet. They should cover most threats and worst-case scenarios.
If you need access to your Synology device from outside your home network, use a VPN or an SSH tunnel.
Best practices only if you do not want to access your data outside of your local network – and that is probably no longer the standard case since data you cannot access from mobile devices etc. is pretty useless. And for compliance and security reasons, many users and companies cannot legally use cloud services and have to therefore to use a 'private cloud', i.e., some local server, for example a NAS accessible from the Internet. A manual configuration is of course recommendable but in the end, a 'private cloud' has to be exposed to the Internet and you have to trust your software vendor. The most you can usually do is to protect your LAN by putting your 'private cloud' in a DMZ (although for consumers, that is usually not an option since consumer routers do not offer a real DMZ).
It doesn't need to forward ports or expose the login system. The BTSync server is still a vulnerability, but it's under it's own user and should give less exposure than the other services like the DSFile that check the login/password. Potential damages on a simple breach (i.e. the sharing key leaked or was guessed) should be limited to the shared folders. I hope.
On iOS, you can use profiles I guess but that is not a standard function.
Use keys and only keys instead...
http://www.chainsawonatireswing.com/2012/01/15/ssh-into-your...