I've really enjoyed reading all this input. It's given me a new level of understanding in data security. These posts have even inspired the 'higher ups' to review our security practices in all areas of our data collection and storage prompting several improvements that have been given top priority, so a huge thanks to all here.

Our company has a pretty extensive server room where we host the database servers, as far as I know we have one firewall with DMZ. The server room is physically accessible via one video monitor/ lock system and a second security door. We run dozens of apps off the db servers which is were our renewed audit of security is currently focusing to ensure integrity. Network is also being reviewed as we have a pretty extensive one.

As we get further into this I can see that it isn't a matter of just turning on CAPTCHA and inserting a SSL cert. This will be a long project of its own needing some dedicated thought and planning. I'm glad I asked here first!

That's actually a pretty good idea. I'll check with our hr dept to see if that's a process they'd be interested in adopting. Thanks.