Here's something I hear quite a bit when talking about security things:  Our site isn't a target, it doesn't have anything valuable on it  This is usually the retort that comes back in defence of some pretty shady practices and in the mind of the defendant, it's a perfectly reasonable