To be really secure, you probably need two different forms of backup. I would probably do thumb drive backups and a cloud backup. Instead of thumb drives, you could invest in an external hard drive.
For thumb drives, I would probably keep multiple thumb drive backups (2 of each backup, then keep the backups 3 deep -- meaning, I wouldn't recycle the first two copies until I need a 4th copy). This way if one of the thumb drives fails, I still have a copy on another thumb drive. If both current thumb drive backups fail, I can go back to the next most recent backup. This would be my "on site" backup. Thumb drives are relatively inexpensive, but their smallness can make them easy to lose. An external hard drive is easier to keep track of, but are more expensive.
If you decide on CD backups, you need to get re-writable CDs (designated CD-RW instead of CD-R). Those allow you to re-use the CD. However, in that case you need to erase the CD each time you want to re-use it. This is more time-consuming than other forms of backup, and not necessarily more secure than thumb drives.
When you say thumb drives don't last as long as CDs, I assume you mean the data on them does not retain integrity as long? This is not an issue if you are doing regular backups, as there is not enough time for data to be lost. If you mean a thumb drive will fail sooner than a CD, I don't know if that's actually true but, if it is, I don't see how it really matters since thumb drives are relatively inexpensive to replace.