Here's an article on WSE 3.0 security that a colleague recommended...I haven't had a chance to read through it, but she recommended it highly, so I'm betting it's worthwhile.