Hi Rick,
I am a developer and I have IIS running on my desktop. I use it only for my development area. Anyone within the company can come to my website through my IP address assigned to my local machine.
What I did is I am using session variables and I make them log in. I verify them against my own database I set up. Once they log in, I keep track of a few session variables that I pass into every page I create, if the session variables are not populated with the correct information, I bounce them back to the login screen. Seems to work for me, I am not sure if anyone can hack in using some program I haven't heard of. This way works for me.
Hope this helps.
ksbigfoot