The backup stories enterprise IT leaders actually read.
Volume 341, Issue 3 · 9 articles from 6 issues
A review of six Linux backup tools matched to different user types, from desktops to server fleets.
Different Linux users need different backup solutions depending on their requirements. Desktop GNOME users benefit from Deja Dup's simple interface, while professionals may prefer Kopia or Restic for more control and cloud flexibility.
Terminal-focused sysadmins can use BorgBackup for native deduplication and encryption. Users managing multiple machines will find UrBackup's centralized server dashboard most practical.
The article notes that most Linux backup tools offer file-level snapshot backups rather than bare-metal image recovery, unlike many Windows alternatives.
Traditional backups fall short against ransomware, making dedicated disaster recovery essential for continuity.
Legacy backup approaches were built for hardware failures, not coordinated cyberattacks that compromise production and backup systems at once.
IBM research found 76 percent of organizations needed more than 100 days to recover from a cyberattack even with intact backups.
Downtime costs are steep, with small and midsize businesses reporting expenses over 100,000 dollars per hour and some unable to survive far smaller losses. Disaster Recovery as a Service maintains live replicas in secure cloud environments with automated failover, cutting recovery from days to minutes.
The DRaaS market is projected to grow from 18.89 billion dollars in 2025 to 83.15 billion dollars by 2034.
Backup capacity planning should use probability-based forecasts instead of rigid growth assumptions.
Brien Posey argues that traditional backup capacity planning fails because it assumes the future is predictable, as in taking 500TB of data growing 15% per year and rounding up.
That growth rate is often unverified, and plausible events like longer retention periods, changed deduplication ratios, acquisitions, or a new AI project can derail the estimate. Capacity planning has always been about probability and hedging, but nobody likes to talk about the uncertainty.
Posey suggests treating capacity planning like weather forecasting, where forecasters express confidence as probabilities rather than certainties, and narrowing the plausible range using historical bounds.
Capacity estimates should evolve continuously like weather forecasts rather than remain static annual numbers.
In the second part of his series, Brien Posey extends the weather forecasting analogy to backup capacity planning.
Nobody knows exactly how much backup capacity they will need, so the task is establishing a range and making an educated guess based on probabilities that are not arbitrary.
The key point is that capacity estimates should not be static; like a forecast, they should be revised as new information arrives. Posey examines forecast confidence as a function of time, noting that near-term estimates warrant more confidence than long-range ones.
Comparison of ten leading online backup services rated on recovery reliability, encryption, and pricing for 2026.
With the backup and cloud storage market projected to grow from $142.7 billion in 2025 to $223.4 billion by 2034, the article tests leading services on recovery reliability, encryption standards, and price.
IDrive is named best overall for multi-device households, Backblaze the simplest choice for a single computer, and Carbonite the best set-and-forget option with unlimited storage.
Acronis combines backup with anti-ransomware features, CrashPlan targets small business endpoints, pCloud offers lifetime pricing, and Proton Drive leads on privacy with end-to-end encryption. The piece stresses that sync-first services such as Google Drive, Dropbox, and OneDrive are not substitutes for dedicated backup software.
Guide for UK SMEs on using immutable backups as a critical recovery control against ransomware attacks.
Immutable backups prevent attackers from deleting or tampering with restore points, providing a reliable recovery path when ransomware compromises production systems.
The article emphasizes treating backup administration as a privileged function with separate identities, MFA, and controlled access. Key recommendations include implementing retention locks before data is written, maintaining tiered copies with both immutable and air-gapped protection, and conducting regular restore testing under incident conditions.
The design must also harden the backup control plane, monitor job success, and align retention periods to realistic detection windows and business recovery objectives.
Red teamers routinely exploit backup systems via default passwords and over-privileged service accounts.
Backup servers are frequently the least secured yet most powerful systems on a network, making them prime attack targets.
Key vulnerabilities include default passwords left unchanged, unmonitored service accounts with excessive privileges, and weak admin authentication.
Recommended fixes include changing defaults, inventorying service accounts, separating admin logins, implementing MFA or passkeys, and monitoring for anomalies. The goal is to stop attackers from using backups as a launchpad for broader network compromise.
With a 29-day median ransomware dwell time, every restore point in a typical retention window is already compromised.
Mandiant's M-Trends 2025 report puts median ransomware dwell time at 29 days when organizations discover the intrusion themselves.
A typical configuration of daily incrementals with a seven to fourteen day rolling window means every restore point was created while the attacker was present.
Sophos found only 54% of organizations with encrypted data restored it from backup, the lowest rate in six years.
GFS retention extends recovery options past realistic dwell times, but only Compliance-mode Object Lock prevents deletion by a compromised admin, root user or the backup software itself.
A three-part ransomware framework covering prevention, containment of lateral movement, and post-attack recovery.
Security specialist snorkel42 lays out a ransomware response strategy in three phases.
Stopping the breach relies on phishing awareness plus technical controls such as application whitelisting.
Slowing lateral movement depends on network segmentation and behavioral analytics. Managing post-attack recovery requires a tested incident response plan.
The piece stresses that ransomware differs fundamentally from standard disaster recovery because attackers remain active during restoration, which demands distinct tactical responses rather than a conventional DR playbook.