In reply to Armin Grewe.

Thats 100% on the money. Weak installations, previous security matters all can result in data compromised. Its actually one of the areas I love about .NET is security and roles are in the .NET framework and can be as coarse or granular as a developer wants it to be. There is no reason to "roll your own" as its already in there. Same "now" with MVC and SEO etc, there is really no reason to go outside the framework itself as it can do anything one wants it to really do all in a solid unified codebase.