You can build a Web commerce site without outside help these days. Still, it's worth getting professional advice on security and having a security assessment done regularly by an outside consultant. A Web-site consultant will understand most of the issues and explain the options. How much security you put in place should depend on what your site does. Being small is no protection.
Hackers target small businesses because they're easy marks.
The old adage about an ounce of prevention applies. If you lose vital company data to a virus or if a hacker shuts down online orders for a week, earlier savings on security will be cold comfort. That doesn't mean everyone needs the most elaborate security available. At a minimum, you should have virus protection, though. Your operating system, whether it is NT, Unix, or another system, needs to be secured before you set up your Web site.