...have kick ass backups. Finally, absolutely minimize the kinds of information and transaction you expose to the risk of webattacks- drop those ad banners, minimize collecting private information, and validate transactions on the back end as much...
http://www.computerweekly.com/blogs/stuart_king/2008/10/websecurity-comment.html