While browsing Scott's blog, I found this reference to a security study by @stake, comparing .NET 1.1 and IBM WebSphere, which I wasn't aware of previously.

Quote: "Based on the results of our analysis, @stake scored the .NET Framework higher then WebSphere running on either Unix or Linux."

Looks pretty credible to me since @stake is well known and independent. So everyone out there thinking that MS isn't for the enterprise since it's not secure, read the study!