Best way to secure data & web site

Hi all,
I've worked with ASP.NET before, and have used the Membership and Roles providers with success.
A client has asked me to build a secure web site. They know a little bit about web security, but have a couple of questions:
1. To build a secure area to a web site, is a SSL certificate necessary, or will the security features in ASP suffice?
2. Will the data itself be secure, or should it be encrypted? Passwords are encrypted in a database, but should all the data that's stored have some sort of encryption?
3. If the data connection string is stored in web.config, will that be secure or should another method be used?


Thanks,
Adrian

...