1. I use hardware RAID 1 for a base-level 'backup,' though that is a misnomer. The reason I have it is to provide a first port of call in the event of disk failure.
2. Secondly, I back up to another internal drive - a complete disk image every week. This way If the RAID array falls over, I can apply this disk image to a disk and be off again.
3. Thirdly, I write a disk image to a NAS disk every other day so that if a virus were to infect the system and chew up both the RAID 1 array and the internal backup disk, that NAS backup would be safe.
4. Fourthly, I make bi-monthly backups to a removable USB hard drive which I store elsewhere in the building. That way, if a virus infects the entire network, that copy will be immune.
5. Then finally, every month I aggregate these backups and have a courier collect my hard disk, deliver it to the head office of where I work for storage, then have the disk returned to me. This is done every month and provides a secure, off-site, virus immune backup without the worry of a third party sniffing through my data or a third party's servers being hijacked.
Paranoid? You bet. But if I were to be held responsible for the loss of financial data of clients with a collective worth of over £100 million for a small business such as the one I work for, my life would not be worth living.