Foundations of Network Security (IIS, SQL, RDP, etc) for a Developer

Question

Not sure if anyone listened to Hanselminutes episodes 134 and 135, but at the end of show 135 Scott Hanselman had a lot of great advice on how to setup a baseline secure environment for a web application. As a developer, most of my time is focused on developing the application, not on the network facet of the project, however as a startup, this is still an important component, and without a security consultant, how does one achieve and properly setup the same knowledge Scott had on the subject?

I guess I'm looking for some reading (book, article, website) on the topic that would help me understand Scott's recommended approach for setting up a secure network environment to host the application. IIS, SQL Server, Firewall, updating the site without having to use 'Remote Desktop' (to avoid any RDP vulnerabilities), etc.

p.s. Jeff - nobody is faulting you for not having any money for the additional servers, we know you would if you could afford it. Don't take that 'banker' crap from Scott, that guy has been working at Microsoft for too long and forgot what it's like to be broke as a startup... hahaha.

Edit: To be clear, I'm not talking about code security, I'm talking about encrypting traffic between servers, network topology, firewalls, etc.

Edit #2: Changed topic.

Answer 1

owasp would be a good place to start.

Answer 2

Since you're an ASP.NET person, you might look at the Microsoft Press book Improving Web Application Security ISBN 978-0735618428. The entire text is hosted on MSDN here. There are also dead tree versions and ebook versions available.

I would in particular point out these chapters:

Chapter 5: Architecture and Design Review For Security

Chapter 15: Securing Your Network

Chapter 16: Securing Your Web Server

Chapter 17: Securing Your Application Server

Chapter 18: Securing Your Database Server

Admittedly its a bit out of date (.NET 1.1, IIS 5.0, SQL Server 2000) but the basic principles are there.