You could write an HttpHandler or an HttpModule to handle the security.
Basically your HttpHandler or HttpModule would need to perform the security
check and give an Access Denied message if the user does not have access, or
if the user does have access, set the content type and write the file to the
Response stream.

Also, note that you will have to set up IIS so that the ASP.Net application
handles .doc, .ppt, and whatever other files you want to provide security
for.

Try looking at these 2 artickes at:-
http://dotnetjunkies.com/WebLog/richard.dudley/archive/2004/05/21/14215.
aspx

and

http://www.microsoft.com/india/msdn/articles/57.aspx

Hope it helps..
Patrick

Thanks, that's quite helpful. i will try that out later.