Integrated Security question

I have been trying to understand how the asp.net integrated security works, but did not find good resources. Here is what I tried then.
I deployed a web app on the same server as the sql server, and enabled integrated security on sql, added network services as user to sql, and set my connection string to integrated security = sspi. It works good.
 Then I deployed the app on a remote machine, and changed the connection string to point to the sql server, and it still works good.
 That made me worried, because the neighbors could write a web app and figure out my sql server name and have fun with my data. Am I wrong somewhere in the line, or should I do something differently?
I appreciate your response.
...