IIS Security

I've just taken over a new site I notice that we have a website that is supposed to be secure - for logon purposes when you connect to https://website name  - you get an ssl connection however if you can enter http://website name - you get to the same logon ...

The following is the situation: I would like to have one virtual directory containing my ASP.NET web application. The web application will serve pages for various stores such as [link], [link], [link] and so on. ...

Hi! From a security perspective, what is the difference between these two scenario : A) Using a Login web control (.Net 2 or +) over a SSL connection B) Using windows integrated security to logon the web site Which one is the most vulnerable (hacking) ? ...