To catch the bad stuff, keep your users productive, and cut down on time cleaning up compromised computers, here are our recommendations for getting web security right.