I have a domain xyz.com and a member server running Windows 2000 Server. I
have created an application which I would like to host it on IIS. The first
level of security that I would like to implement is that, this website should
allow access to users only from xyz.com. Hence in ...

I have been looking around the web, went through the step-by-step guides and
I wanted to know if I can do these following things and HOW:
1) I have found no where to protect http://localhost/WebApp/Browse.htm with
a different role than http://localhost/WebApp/Edit.htm. So my ...

We have a web-serve with IIS 6.0 on Server 2003.
SSL is enabled, and the appropriate folders are check-marked to require SSL
communication.
Our problem is this:

We recently got audited and were told that we need to do the
following:
Disable SSLv2.  Only SSL3 and TLSv1 should be enabled.
Also, disable the ciphers EXP-RC4-MD5 and DES-CBC-MD5.

I have just purchased a falsh program that updates weather data ivery
2 seconds and shows temp, wind direction/speed etc with gauges.  I
have set it up on my local server on XP Pro, iis v.5,  Everything
works the way it is supposed to until I select to lock the program

Can anybody let me know what the current 'best practise' is in regards to
the Default Web Site?
Depending on who I speak to I get a different answer, therefore, I am trying
to find where it is defined (whitepaper, KB article etc.)