iis and security?

Hello

Sometimes when I try to run a project in studio.net ,it runs without any trouble but in other times (all of the projects that I make) , it demands that I will define a virtual directory for my project in the IIS.

1) Why?

2) From all that I read and heard the IIS when installed on fat32 is considered to be wide open...

My system is not responsible for all the bank accouts on this planet, so I will sleep good at night with the chance that someone will break into it (If he'll ask politely - I might even give him a guided tour into it ;)

But if a work can be done the right way - it should be done that way!!!

So I do have to work with the IIS - I saw that I can use the web.config instead of the IIS to authorize navigation throw the system.
Is that enough to leave the IIS with anonimous login and do all the work from the .Net to maintain security?