mdirvin

camc said:

I found that an encrypted backup is even better, in case you have to deal with ransomware attacks.

Maybe it is worth taking in consideration units that offer snapshot duplications with complex encryption keys.

I had to face a ransomware attack a couple of years ago: both the file server and the backup unit, which was a standard NAS, were completely defeated – no hope to retrieve anything from either unit. The Syneto unit that was sitting on the same network got under fire too - but only the last snapshot was accessible via the network, so it was the only one that got corrupted. 
I've successfully restored the previous snapshot in less than 15 minutes (I keep 24 daily snapshots on this machine) and got everything back.... it was really a life saver.

Since then I rely on a three-level backup: a standard Time Machine on a thunderbolt drive, an encrypted backup via Carbon Copy on the Syneto unit and the icloud stuff on another level. Of course the management of the above is not the simplest, but it seems a fine cover...

  I agree, it use to be hardware failure was the main concern when designing a backup plan.  Ransomeware has completely changed the game.  I discussed this with a cyber security expert.  Her comment was Ransomeware is either to total disaster for the victim. Causing companies to go out of business losing everything, or just a minor irritation.  The difference being a few simple steps that everyone should be doing.  Mainly keep an up to date, verified backup that is inaccessible to the ransomeware.  There are multiple ways of doing that, Cloud backup, physically plugging, and unplugging the backup device before and after each backup. I use two Netgear (526X, & 524X) servers, having one backup the other using the server OS. It does an hourly, daily, weekly, monthly backup schedule without mounting the backup disaster recovery share on the network.  The locked backup share is not network accessible, but If it were mounted somehow it is read only.  In order to access the backup share I would have to go in as the administrator and make a duplicate copy, then set the permissions so I could access the copy. I also keep a backup on a Backblaze B2 cloud account, just in case.  Then  a backup to a thunderbolt 2 device inside an encrypted password protected (not stored in the keychain) sparse bundle. I have been using Chronosync as my backup program. Have been for years.  It works especially well for networks, and cloud backup.