I was on Ketih Brown's session on TechEd in Barcelona about ASP.NET security. He mentioned great site with all types of security resources for programmers. You should check out Microsoft Security Wiki at Channel9. You can also find his training modules about Input and Data Validation in the Training modules section.

When I was digging into implementing custom application settings I found one great article on CodeProject. Title of article is Unraveling the Mysteries of .NET 2.0 Configuration. Article explains everything about custom configuration sections, elements, collections, saving settings and using them in applications.