I'm trying to learn more about Port security in a database app where we'll have WinForms and a middle-tier behind a Web Service. I've been asked to provide info on what IIS offers, and here's all I know (which is very little)...

I know that incoming and outgoing Web request properties can run on different TCP ports (ISA server listens for outgoing Web requests on TCP port 8080, while the listening for incoming Web requests is on TCP port 80.) And I know that they can be changed, so long as they both are different.

Unfortunately, I don't know how to translate that into a statement (say, to provide to a customer who wants to know how security will be in our app) that a customer would understand.

Any thoughts? Sorry to be asking such a novice question!

Thanks,
Kevin