Security is nearly always a tradeoff. As the value assigned to security goes up, some other value goes down.
The first value you usually notice is profit. The more you spend on security the more security you get but the less profit you end up with.
Before spending any significant money on security (and remember, time is money), you should try some risk analysis.
Determine what X minutes of downtime would cost your clients. Determine what a complete server compromise or a partial compromise (such as a read-only database dump) would cost. These costs might include loss of reputation that extends beyond this three month promotion.
The next step is somewhat more difficult to get accurate numbers for. Try to guess how likely any of the above scenarios are. Talk to your clients about this because they may have received threats or extortion attempts that should be factored in to your guesses. You should probably include downtime due to non-malicious DDoS (otherwise known as going viral) because the mitigation strategy is similar and the fact that you are down just as you should be making the most money is particularly painful.
Once you know your expected losses, you can spend money and time trying to mitigate them.
DDoS and penetration testing are completely different things. For DDoS protection, the most sensible thing to do is to use a service designed to stop it. Companies like Verisign and Prolexic have services that do nothing for you apart from filter DDoS attacks. Companies like CloudFlare have a service that does caching and CDN distribution which makes your site faster and gives it more capacity, and also happens to include DDoS protection.
There are two things to do to prepare for compromise attempts:
- Secure your site as much as possible.
- Prepare for what should happen if/when you do get compromised.
You absolutely should try to do some simple penetration testing yourself. Grab one of the free automated web scanners and run it across your site before it goes live. This will find the easy vulnerabilities and allow you to fix them yourself before employing the services of the third-party penetration testers (if you determined they are worth the cost). They should find more than what the automated scanners did.
To preparing for a compromise, you should have:
- Enough monitoring to determine that you have been compromised. AIDE/Tripewire/OSSEC are good tools for this.
- Regular backups and a tested plan for how to re-install from them. It's important to test your backups. I can't tell you how many times I've seen the first test-restore-from-backup attempt fail.
- Enough logging to determine how the intruder got in. You have to know this and fix the vulnerability or he'll just get straight back in.
- Potentially spare machines that can be swapped in when the main one gets compromised. Sometimes you don't want to wipe the compromised machines because they hold the evidence of how you were compromised but you can't leave them online and you must keep the site up. That's what the spare machines are for.