How do I restrict access?

Hi,

I am having difficulty understanding access control under Anonymous Authentication mode.

I simply want to restrict access to certain HTML/PHP/JS web "apps". Do I need to have to separate sites? Or is there a more efficient/secure way? And how do you set ACLs?

I also have similar dilemmas concerning Windows Media Server, but I guess it's a more general information I am looking form but I also figure WMS is older than IIS 7.5, so it's not quite the same.

Any help is appreciated...

 Cheers