Ok, so I finished developing my internet site. It uses a federation provider to authenticate public user. Now what I'm concern of, is the site security. I see that any logged in user can see the _layouts/viewlsts.aspx page. Even more, they can see data in the lists, and I don't want that to happen.
I searched a lot and find out that users can see even more page I was not aware of. For example http://site.url/_vti_bin/spdisco.aspx They can see some webservice sharepoint expose ect
Is there any article with best practices to make my site secure?