SecurityFocus released an article by Rohyt Belani and Michael Muckin about IIS 6.0 security.
This article discusses the major default configuration and design changes incorporated in IIS 6.0 to make it a more secure platform for hosting critical web applications.
Read the full article here: SecurityFocus HOME Infocus: IIS 6.0 Security