If that's the only thing you've thought about, then likely the answer is "no, that's not enough". I'm assuming that's not really all you have thought about, but just in case...
"Enough" is something that is determined after a detailed threat analysis by someone (or a team of someones) that knows what they are doing. Web applications are wonderful attack surfaces, and while Microsoft made it relatively easy to properly build a reasonably secure website using ASP.NET, it's still very easy to not build a secure website.
Simply putting something together and putting out there isn't enough, even for a website that contains no sensitive data.
There are many threats to worry about:
- SQL Injection attacks
- Cross-Site Scripting (XSS)
- Someone figures out a way to get your website to serve up malicious JavaScript. Usually this is done by injecting the script into a database and then counting on the developer to not know enough to escape the database output. It can also be done if the attacker has access to your file system, but putting the payload in the database is much more common.
- Cross-Site Request Forgery (XSRF)
- This is when someone uses XSS to put a malicious JavaScript on YOUR website that then goes and performs unauthorized transactions (often without your user's knowledge) on another website. (This is why it doesn't matter if your site has sensitive information or not. If you aren't coding to prevent XSS, your website can be used to attack websites that do have sensitive data.
Those are only the first thing to pop into my head. There are a ton of other issues to be concerned with. But this forum isn't meant for that type of in-depth answer.
I suggest starting here: http://msdn.microsoft.com/en-us/library/ff649100.aspx Once you've digested that, I'd strongly recommend becoming familiar with the OWASP Top 10. http://www.owasp.org/index.php/Top_10_2010-Main You're asking about a small sliver of the things you need to be concerned about.
