On a linux box using .htaccess you can deny access to folders etc... and when the user attemps to visit that directory/file, a window pops up asking for username/password.
How would you do this on iIS 6?
In the IIS MMC you could do the following:
Then add a local Windows account and add that user to have "Read" access to the directory using normal NTFS permissions.
It will prompt for a password and the Windows Account credentials will let you in.
I've used IISPassword in the past with great success. I believe that this will work with IIS6.
UPDATE: just checked and it does work on IIS6 - no updates since 2009 though...