What is the difference between backup and redundancy, and what makes a good backup strategy?

Redundancy protects against component failure — a duplicate disk, power supply, server, or link keeps the service running. It is about availability, and the copies are live and synchronised.

Backup protects against data loss — deletion, corruption, ransomware, or a bad change. The copies are separate in time as well as location.

The distinction that matters: RAID is not backup. A deleted file, a corrupted database, or an encrypted-by-ransomware volume replicates instantly across every disk in the array. Neither is synchronous replication to a second site. Believing redundancy provides backup is a common and expensive mistake.

A good backup strategy:

• The 3-2-1 rule — three copies, on two different media, with one off-site. It survives hardware failure, site loss, and most ransomware.
• Immutable or air-gapped copies. Now essential, because ransomware specifically targets backups. A backup reachable with the credentials the attacker stole is not a backup.
• Frequency matched to your RPO — how much data you can afford to lose.
• Retention matched to legal and regulatory requirements, including versions far enough back to predate a slow corruption.
• Monitoring, so a silently failing backup job is noticed before it is needed.

Note: The point to end on: an untested backup is not a backup. Regular restore drills, timed against the recovery objective, are what turn a policy into a capability — and a great many organisations discover theirs is unusable only when they need it.