Try to group resources like ASPX pages under folders that represent roles in your system.
Take, for example, the Management folder in the Planet Wrox website. All pages related
to the management of your site are packed together in a single folder, making it very easy
to block the entire folder with a single element in the Web.config file. When
the files you want to protect are scattered throughout your website, you’ll need more time
to configure the application, and you’ll end up with a cluttered view of the active security
settings.