Hi,
The best way would be to build a separate backup domain, where only your DPM servers are located, and this backup domain has a one-way trust to your production domain. The backup domain should not be accessible from the production domain and should be closed
down as much as possible.
You can also consider backing up to Azure, this will ensure your backups are secured and safe.
If you're still using tapes, you can pull out the tapes after weekly backups and change the tape, and store the tapes somewhere physically safe.
Best regards,
Leon
Blog:
https://thesystemcenterblog.com
LinkedIn: 