I'm looking for security solutions for my web servers from within the web service level. Is there any software that can run on top of IIS in Windows? Further, are there any best-practices that web administrators follow to secure their servers? (ASP.NET, IIS6 or IIS7, and server 2003 or 2008 supported)
I've heard of application firewalls such as dotDefender, but it's costly. I see this as an extra level of security that could help stop intruders breaking not so well coded sites.