Following on from my thread here: http://forums.asp.net/t/1568763.aspx I'm in the early stages of designing an ASP.NET based enterprise management system. I thought I'd shared the security policies we've tentatively settled on - partly for feedback, and partly as a point of reference for anyone else going through the same process. The data is business critical, accessed by a wide variety of users, variety of browsers via the web, from stations we do not control. We don't need military or banking level security, but do need a reasonable level of security balanced against ease of use.