Security is a large spectrum.  You need to build with security in mind, it is
not something that you can easily lay on top of your service later.  There
are many basic security features built into web services and work for most
people connecting from a IIS web server with Windows domain authentication.  
For more robust implementations you need to use WSE or even third pary
solutions.

1) WebServices run over whatever port you configure the server to listen on.
That could be 80 or 443.  But that is just information, it alone does not
make the service secure or insecure.

2) Login can be handled many ways.  Integrated Windows, Forms, Etc.  Again,
these are tools.  How you use them is what makes your service secure.

This should get you started:

http://msdn.microsoft.com/webservices/webservices/building/security/default.aspx

HTH,

John Scragg

It's good that he's anal about network security, because you don't seem to
take it very seriously.

Web Services can be protected with a variety of methods - SSL, passing
username/passwords into it, forms authentication, Basic IIS authentication,
Windows Authentication, or using Certificates. Microsoft's Web Service
Enhancement Pack has some add-ons for security.

However, for the most part, SSL + Username/Password as parameters in your
web service function call is a good start : )