Securing ASP.NET MVC Application Checklist

Question

I am looking for a set of guidelines or a checklist that you can go over for securing a public ASP.NET MVC Website. I just want to make sure that I am not making any of the obvi

Answer 1

I kinda do the following;

1. Seperate my concerns. Admin in admin folder etc.
2. [Authorize] on all actions that require you to be logged in.
3. Html.Encode all data entry fields.
4. ActionResult Create([Bind(Prefix = "", Exclude = "id")]MyModel newModelObject) <== exclude id's that can be used in an attack

Other than that...