I would like to know if there's any direction eg. documents or anything that gives an idea of how ACL permissions are to be set up on files, folders, aspx pages and dlls in IIS 6. My thing is that when setting up files on IIS 6, I've seen that some people just add the NETWORK SERVICE, Internet Guest...

Hello our company has taken over another company, they've got an web application (ASP-pages, SQL db, file uploads to a folder in the webroot, IIS on a Windows 2003 server). This application is being used internally but also by clients via the internet. The problem with it, is that's directly reachable...