Can I restrict folder contents to authenticated users?

I am using the membership provider and am reasonably comfortable that all of my web pages are safe.
Some of the pages contain hyperlinks to documents (pdf, xls, etc.) stored in a folder under the root of the web site.  I have disabled the ability of users to anonymously list folder contents, but I don't see a way to keep anonymous users from accessing the documents if they know the specific URL for that document.  Example; if the document contains a spreadsheet of current sales, I don't want an ex-employee (who captured the URL while working here) to be able to bring up the current document.
Passwording the documents isn't a good choice because there are hundreds and we'd like to avoid changing them all every time someone leaves, or weekly, or whenever...
Is there a way to restrict access to all contents of a web folder to people who have been authenticated?
Any help is appreciated.
 
...