If that's the only thing you've thought about, then likely the answer is "no, that's not enough". I'm assuming that's not really all you have thought about, but just in case...
"Enough" is something that is determined after a detailed threat analysis by someone (or a team of someones) that knows what they are doing. Web applications are wonderful attack surfaces, and while Microsoft made it relatively easy to properly build a reasonably secure website using ASP.NET, it's still very easy to not build a secure website.
Simply putting something together and putting out there isn't enough, even for a website that contains no sensitive data.
There are many threats to worry about:
- SQL Injection attacks
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (XSRF)
Those are only the first thing to pop into my head. There are a ton of other issues to be concerned with. But this forum isn't meant for that type of in-depth answer.
I suggest starting here: http://msdn.microsoft.com/en-us/library/ff649100.aspx Once you've digested that, I'd strongly recommend becoming familiar with the OWASP Top 10. http://www.owasp.org/index.php/Top_10_2010-Main You're asking about a small sliver of the things you need to be concerned about.