Security is a stance not a feature. Being caught vulnerable and on the back-foot can be /really/ hard to recover from.
Do risk-based security, and be realistic about remote risks.
It sounds like there are already concerns about identified risks.
I'll point out that I did spend a lot of time, energy and money on application security at Engine Yard (and still do as board member) and I'm very proud of our security record there.
Let's face it, security is a tough, technical challenge. The friendly slide decks with clip art of people shaking hands and "consultants" that make us feel good can only get you so far.
reply