You can't secure yourself - it's just not possible. You can only hope someone doesn't pop you, and if it happens that your response game is on point.
Sure you can patch SQLi and the known exploits, to keep out skiddies, but ultimately you draw someone's attention you're going to get owned, there is just no way around it without completely disconnecting yourself the Internet. And even then, DMZ servers have been owned time and time again.
lots of times its not even the main site(in this case ADF) that gets popped, but some peripheral company or vendor and then they leverage that laterally to gain access.
Read through the latest HTP5 E-zine(Hack The Planet - it's still a little dated, 2014 I believe, Nacash mirrors it on GitHub)and you'll see just how easy it is to traverse through "side channels" once you break one link in a very long chain.
They dumped sucuri, linode, and several other high profile security PROVIDERS - even giving an 0day to the trendmicro site(that would be Norton AV).
It would be great if there was a simple 1-click fix to security, but there isn't.
The real question is why all the passwords were either cleartext or sha1.. Someone had to OK that.. And then someone had to actually implement that - without even questioning it. Unsalted too...
