This is so totally my point. Techs (and I prefer to think of myself as one) often react disproportionatly to threats. Everyone does. To be precise: people suck really hard at assesing risk/damage/reward situations. There are studies that demonstrate this.

You paid no attention to the rest of my post, and focussed on one point that you got wrong anyway. How do you know I keep our clients credit card numbers on the server? Is that your rootkit I see before me?

I don't keep credit card numbers, nuclear launch codes or the secret of the mysterious cities of gold on my webserver. I keep webpages that people wish to share with the world. Not their credit card numbers. That was the whole point of the security matrix - to evaluate the effort I need to expend to counter threats, based on the damage to my business.

You argued my case much better than I could. You immediately created an example using the worst possible damage imaginable (severe damage to my client's businesses) and argued your case from there. What crucial information could be sent to nasty.crack.net from a webserver? The passwords is the best I can guess. I can change my passwords.

And what is the value of the information lost since the last backup? Is it worth more or less than the cost of spending days making the server completely bulletproof, and the incovenience of working with a fully-secured system? It's a lot less.

This arguement should be setting off flags in your memory. It is the reason why a certain large company we love to hate can flog crap OSs and get away with it. They are surfing the 'high risk' part of the matrix, but they are on the low damage side. Most information is less valuable than you might be led to believe.

____________________
Jeremy
I didn't believe in evil until I dated it.