Question: I'm working with a start-up, mostly doing system administration and I've come across a some security issues that I'm not really comfortable with. I want to judge whether my expectations are accurate, so I'm looking for some insight into what others have done in this situation, and what risks/problems came up. In particular, how critical are measures like placing admin tools behind a vpn, regular security updates (OS and tools), etc. 

Keep in mind that as this is a start-up, the main goal is to get as many features as possible out the door quickly, so I'll need as much justification as I can get to get the resources for security (i.e. downtime for upgrades, dev time for application security fixes).

Background Info:

* Application is LAMP as well as a custom java client-server.
* Over the next 3 months, I project about 10k anonymous visitors to the site and up to 1000 authenticated users.
* Younger audience (16-25) which is guaranteed to have an above average number of black-hats included.

Thanks in advance for your responses, and I'll welcome any related advice.

Answer: 
If security isn't thought of and built into the application and its infrastructure from day one it will be much more difficult to retrofit it in later. Now is the time to build the processes for regular OS/tool patching, upgrades, etc.

* What kind of data will users be creating/storing on the site?
* What effect will a breach have on your users?
* What effect will a breach have on your company?
* Will you be able to regain the users' trust after a breach?

Since your company is dependent on keeping existing users and attracting new ones, you should present your concerns along the lines of how the users would react to a breach. The higher-ups will understand that the users are your bread and butter.
A few basic "security" measures here that while are more reactive than proactive, are some things to consider.

1) Backup strategy, of course not just for those who hack into your site, but it is nice to restore everything back to pre-hack days if possible, make sure it's reliable and most importantly was tested in a near-live restore drill  

2) Mitigation, have plans in place at least on a napkin somewhere for how to react if the server is hacked  

3) Insurance, find insurance companies that understand the world of cyber-business and the damages resulting from these things, buy policies  

4) Someone already mentioned employee sabotage problems, you're screening your employees beforehand right? Background checks are cheap and do dig up stuff...