Question: I'm working with a start-up, mostly doing system administration and I've come across a some security issues that I'm not really comfortable with. I want to judge whether my expectations are accurate, so I'm looking for some insight into what others have done in this situation, and what risks/problems came up. In particular, how critical are measures like placing admin tools behind a vpn, regular security updates (OS and tools), etc. 

Keep in mind that as this is a start-up, the main goal is to get as many features as possible out the door quickly, so I'll need as much justification as I can get to get the resources for security (i.e. downtime for upgrades, dev time for application security fixes).

Background Info:

* Application is LAMP as well as a custom java client-server.
* Over the next 3 months, I project about 10k anonymous visitors to the site and up to 1000 authenticated users.
* Younger audience (16-25) which is guaranteed to have an above average number of black-hats included.

Thanks in advance for your responses, and I'll welcome any related advice.

Answer: 
These will probably be obvious:

* Limit password attempts.
* Sanitize your database inputs
* Measures to prevent XSS attacks

It's also worth mentioning that, as you said, the network architecture should be set up appropriately. You should definitely have a decent firewall that's locked down as much as possible. Some people recommend putting your systems between dual firewalls of different makes so that in the event one of them has a critical vulnerability, the second will most likely not have the same vulnerability and you'll be safe. It all depends on what you can afford since it's a startup.
Have a look at Mod Security for the various possibilities in the software setup:
Do a Google search for "mod\_security howto example"

Simple example to start: <http://www.ghacks.net/2009/07/15/install-mod_security-for-better-apache-security/>