What should I say? ... that is how we always treated when doing business critical dataprocessing.

It is how we viewed it when we were doing ha/cmp (high availability) product ... some past posts
http://www.garlic.com/~lynn/subtopic.html#hacmp

and post referencing meeting on ha/cmp and database scaleup in jan '92
http://www.garlic.com/~lynn/95.html#13

two of the people in the above mentioned meeting left a year or so later to join a small client/server startup responsible for something called the "commerce server". We were called in as consults because the startup wanted to payment transactions on the server. Part of the effort was something called the payment gateway ... some past posts:
http://www.garlic.com/~lynn/subnetwork.html#gateway

and the effort is now frequently referred to as electronic commerce.

post regarding recent checkfree attack and reference to "Web Security hasn't moved since 1995"
http://www.garlic.com/~lynn/2008r.html#42

and related from today:

Kaspersky calls for a more secure internet
http://www.vnunet.com/vnunet/news/2232134/governments-banks-failing-web

from above:

Governments and banking institutions are still failing to pay enough attention to internet security, and allow too much responsibility to rest on the shoulders of consumers

... snip ...