I don't know that ASP is itself not secure, but there are certainly more security features in .NET. You can even implement them in classic ASP:
http://weblogs.asp.net/scottgu/archive/2007/03/04/tip-trick-integrating-asp-net-security-with-classic-asp-and-non-asp-net-urls.aspxOne thing to do though, is try to look at ASP.NET as completely different than ASP way of doing things. I have seen a lot of code that is in .NET that looks like classic ASP code, and though it may work, it is not good programming design and is not maintainable. It is also slower in many cases, since the page has to be evaluated instead of having compiled code in a DLL.
