As an update to my earlier post, an updated web service security guide has been posted and now it works against WSE 3.0!!  Not only that but there are huge improvements in this release vs. the others.  I would highly reccomend taking a look, given the fact that WSE 3.0 isnt too far off now that the release of the .net framework 2.0 is imminent.

In addition take a look at this PAG guide on overall security in .net - there is a great chapter on Web Service security.  And here is some security guidance on the .Net framework 2.0.  There are all great guides from our PAG team.  Without them my job would be much harder.