Question: I'm working with a start-up, mostly doing system administration and I've come across a some security issues that I'm not really comfortable with. I want to judge whether my expectations are accurate, so I'm looking for some insight into what others have done in this situation, and what risks/problems came up. In particular, how critical are measures like placing admin tools behind a vpn, regular security updates (OS and tools), etc. 

Keep in mind that as this is a start-up, the main goal is to get as many features as possible out the door quickly, so I'll need as much justification as I can get to get the resources for security (i.e. downtime for upgrades, dev time for application security fixes).

Background Info:

* Application is LAMP as well as a custom java client-server.
* Over the next 3 months, I project about 10k anonymous visitors to the site and up to 1000 authenticated users.
* Younger audience (16-25) which is guaranteed to have an above average number of black-hats included.

Thanks in advance for your responses, and I'll welcome any related advice.

Answer: 
Also, don't forget you need to have your server secured from current (that is, soon-to-be-past) employees. Several startups were totally wiped due to employee sabotage, e.g. <http://www.geek.com/articles/news/disgruntled-employee-kills-journalspace-with-data-wipe-2009015/>
If you're explicitly trying to attract the sort of users who are inclined to try to crack systems, then you can pretty well bet that your system *will* come under attack.

You should suggest to the management that if they're not going to take security seriously, then you should just go ahead and post the company's bank statements and accounting books (in clear text) on the site, with a prominent link from the home page. At least that way, you can tell them, the end result will be about the same, but they're less likely to damage everything else to get what they're looking for. 

I'd think that the reputation issue might have a slightly different cast with this audience, too -- they may forgive you for being hacked, but they probably *won't* forgive you for being an easy target.