Once again, I hope this will be acceptable or fixable and once again, thanks for everything. When considering issues of computer security, it is sobering but important to realize that the deck is stacked almost entirely in favor of the determined cracker. For an invasion to succeed, it is sufficient that ONLY ONE of the attack modes be effective, whereas for an invasion to be repelled, it is necessary for ALL of the defenses to be effective. To resolve this inherent conflict, upper management must be verifiably made aware of the risks so that the proper trade-off can then be made. The situation is comparable to retailers maximizing net sales revenue less the cost of shoplifted goods.
All retailers understand that losses are a cost of doing business.
Similarly, the potential for embarrassing and perhaps costly incidents is the cost of doing business on the Web. Meanwhile, assuming the target is sufficiently attractive, such as a high-volume or high profile web site, the potential for attack continues unabated. It is also important for the computer or network or web site security manager or consultant to participate in private groups of professional peers with aligned interests and good connections to the larger security community and the hardware and software vendors. In short, prevention is impossible but mitigation is a worthy and achievable objective. Substantial technical skill and access to current information are necessary resources.