Can any of you security experts help me make a decision on how to deal with staffing for an initial hardening for an Apache server running MySQL and PHP?
We are working on a new site have to do initial hardening and I don't know if we should have the sysadmin do it or if we should get a security expert to do it. I know our sysadmin can do it, but is he "a security expert", definitely not. I did find this old post on how to harden an Apache server and I think he could follow the instructions. I also read the post on outsourcing security and want to clarify that most of it was not relevant because we would hire someone local for this.
So my questions:
Are there pros/cons to having a security expert do initial hardening for a MySQL server? If the security expert does the initial hardening, will I end up having to deal with the security expert again for routine changes?
We can pay more for better work, I just don't know if it is a good idea in long run and can use your expert advice.