I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are actively available as "live" sites over the public internet to the public.
The reason being: is that the company's contract flash developer would not be able to upload or "test" the flash components and that other third party contractors again would not be able to gain access.
I was under the impression what a third party would use FTP to upload and then authenticate in a browser to view what they've done.
The subdomains are hosted via a third party managed server, but the solution architect is the administrator/super users of the win 2008 boxes.
What would be a good start for assessing and analysing the security of IIS disallowing unauthorised access but allowing third party developers to do their jobs.