I manage a SharePoint Foundation 2010 site, hosted by a web hosting company, that is an Internet-facing site. Most of the lists (Calendar, Announcements, etc.) are for public (anonymous) consumption. For some lists I want to show SOME data to the public. For example, I have a list of members (300+) and I want to show certain views (the current officers, about 10 items, just showing name and title) but hide all other views, and most of the fields (email, phone number, etc.)
I know I can hide the Site Actions menu, and the link to All Site Content; and I have already done that. However, a savvy user (or search bot) can reach the _layouts/viewlsts.aspx page and see all the lists, even if they are not shown in the Quick Launch. Thus, they can reach the AllItems.aspx page for my members list, and then see all views for the list. If I could assign a Permission Level for anonymous users, I would; but I can't do that either.
Since 2010 does not allow us to set permissions for views (why that functionality has not been added in 2010 eludes me), what is the PROPER way to secure an Internet-facing 2010 site?
One final note, setting Anonymous Access to "Lists and Libraries" doesn't work either; the default home page (the top-level site is the standard Team site) is no longer accessible under that condition, unless the user knows to type in SitePages/Home.aspx. What user knows to do that? The home page is not visible on the Top Link bar either. So, Anonymous Access has to be set to "Entire Site".