This is a PDF download from the PAG group at Microsoft. In it are the guidelines for authentication, authorization and secure communication across the tiers. Topics include ASP.NET, Enterprise Services (COM+), Web Services, Remoting, and data access (including ADO.NET and SQL Server).

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=055FF772-97FE-41B8-A58C-BF9C6593F25E