My humble opinion:
As a business owner, you have to balance the cost of backups, the cost of the time to do them, the cost of having no backups, the cost of storing backups off-site, and the probability that some disaster will befall you. BTW, there's no excuse for being attacked by malware.
You can almost guarantee that you will be safe from malware if you:
- deploy a good standalone firewall and shut down all ports except those you explicitly allow
- install a good antivirus program on all Windows computers; you can include Mac and Linux too, if you want
- client/customer media must be checked for malware before being used. Malware is almost bad enough to warrant a standalone, un-networked computer to perform these checks
- do not browse the web unless you know where you are going and what you are looking for; and do not click any links unless you know you want to go there
- do not click links in emails unless you know and trust the source, know where the link will take you and can reasonably trust the destination site.
As to hard drive failures, there are ways to detect when they are in the process of failing. For a business, if your hard drives are three years old, you should buy new ones, transfer the data over, erase and throw out the old ones. It's almost a guarantee that your drives will begin failing more rapidly once they reach three years old of age.
As to backups, you can be paranoid and perform daily incremental backups (to be stored for six months), weekly full backups (to be stored for two years) and monthly full backups (to be stored for ten years). You can rent an off-site data storage facility to keep your backups safe and secure. But be aware that all these pieces of media are going to be *very* expensive.
On the other paw, you could decide that, since you have a sturdy 4-hour safe on site and the likelihood of fire or flood is low enough, you can store your backups in the safe. (I'm sure most professional IT people will fiercely attack me for saying this, but think about it. If your business has burned to the ground, you won't be needing data for a while, and the safe will probably have kept the backup media in good shape. ) You might stick with weekly incremental backups and do a full system backup monthly.
If you are more concerned, you can buy three USB notebook hard drives. Keep the oldest at the office and the two newer ones at home. When it's time for a backup, get the office drive out, backup to it and take it home at the end of the day. Once home, you put it in your home safe and set the (now) oldest drive out to take to work in the morning.
My church had constant problems with malware on Win98. And they didn't have much of a scheme to replicate data. They had enough presence of mind, though, and had never suffered a data loss in the 10 years they were computerized before I came along. Once I got them switched to XP Pro, the malware problems were greatly reduced. Once they bought a dedicated file server and licenses for Trend Micro, malware has just about disappeared.
The main firewall was a Linksys WRT54G running DD-WRT. It was adequate for quite a while, but it was time to move them to more reasonable security. Using an old system, I built a Smoothwall firewall and separated their wireless network from their office LAN. With OpenVPN built in, they can access the office LAN remotely or via wireless.
They are satisfied with performing a full backup the first Friday of each month and a weekly incremental backup the rest of the Fridays. The incrementals are put on a 35GB REV drive, rotating through 4 disks. The monthlies are now stored on a pair of 250GB USB notebook drives; using them once a month, they should last a very long time, and there's plenty of room for their data usage to grow. And they are okay with storing the backups in the safe, where the church records from its start are kept.
Originally, they were using a backup script I wrote to store the incrementals on DVD, but I didn't have the time to expand that, so they eventually switched to Backup Exec. It's far more complex than a small business needs and can be a royal pain to get working right, but it does manage the media and devices pretty well. The 75GB full backup takes 2-3 hours to complete (including verification).
In time, I will move the server from the safe room to a utility closet at the other end of the facility. As good as the safe is, spacial separation of the replicated data is also important.
IT pros will jump all over me for my opinions here; they don't make money when people don't hire them. Small businesses don't have the financial resources to hire IT Pros all the time. But given reasonable options and possibilities, they are quite capable of making choices that are right for them.
So consider the value of your data, the probability of disaster, the cost of a rigorous, large-business-style backup program, and what you'd lose if disaster struck. Then come up with a scheme that does what you need, at a price you can afford. You can spend money on a backup software system or you can just use ntbackup, which comes with XP Pro (and which Backup Exec uses).
Oh, yeah. I'm paranoid. I don't trust anyone else with my data, and I don't trust shipping it across the internet.
Attention: TDR Forum Junkies 
