A new book arrived in the post yesterday - Professional ASP.NET Security, Membership and Role Management by Stefan Schackow (Wrox Press). I'm usually not a big fan of Wrox Press books, they tend to have too many authors attributed to individual titles and the net result is a pretty disorganised read. However this book is an exception to the rule. The first three chapters make it worth the price of the book + postage alone. You get a pretty good insight into how ASP.NET 2.0 initialises upon the first request, how security is processed during a request and a fairly decent treatment of the ASP.NET trust mechanism. I'd also recommend purchasing this book along with Dominick Baier's Developing More Secure ASP.NET 2.0 Applications. What's also nice about both these books is that the treatment of the topic of security (which can sometimes be quite dry) is dealt with in a remarkably interesting, relatable (is that a word?) and non-yawny approach. Most of the examples you can try on your dev box and because the security config is stored in XML config files, if you screw up, just roll back to the default set of files that came with the installation.
Anyhoo...ASP.NET 2.0 security has improved considerably over ASP.NET 1.x and with these two books in hand you'll have no excuse not to enforce partial trust on your internet facing web apps.