Web Security for Developers
Not sure if anyone listened to Hanselminutes episodes 134 and 135, but at the end of show 135 Scott Hanselman had a lot of great advice on how to setup a baseline secure environment for a web application.  As a developer, most of my time is focused on developing the application, not on the network facet of the project, however as a startup, this is still an important component, and without a security consultant, how does one achieve and properly setup the same knowledge Scott had on the subject?

I guess I'm looking for some reading (book, article, website) on the topic that would help me understand Scott's recommended approach for the startup.

p.s.  Jeff - nobody is faulting you for not having any money for the additional servers, we know you would if you could afford it.  Don't take that 'banker' crap from Scott, that guy has been working at Microsoft for too long and forgot what it's like to be broke as a startup... hahaha.

Edit:  To be clear, I'm not talking about code security, I'm talking about encrypting traffic between servers, network topology, firewalls, etc.
Web Security for Developers
===

Not sure if anyone listened to Hanselminutes episodes 134 and 135, but at the end of show 135 Scott Hanselman had a lot of great advice on how to setup a baseline secure environment for a web application.  As a developer, most of my time is focused on developing the application, not on the network facet of the project, however as a startup, this is still an important component, and without a security consultant, how does one achieve and properly setup the same knowledge Scott had on the subject?

I guess I'm looking for some reading (book, article, website) on the topic that would help me understand Scott's recommended approach for the startup.

p.s.  Jeff - nobody is faulting you for not having any money for the additional servers, we know you would if you could afford it.  Don't take that 'banker' crap from Scott, that guy has been working at Microsoft for too long and forgot what it's like to be broke as a startup... hahaha.

Edit:  To be clear, I'm not talking about code security, I'm talking about encrypting traffic between servers, network topology, firewalls, etc.