+1 From my everyday experience, this is a painful truth. If your system is secure as can be, but the (web) application running on it isn't, **** is going to hit the fan.