Add security to IIS Web Server

im developing some web site that run on IIS 7 and can connect to SQL server via php. The problem is i think its not safe because everyone that know my public IP address can freely access my site (the site is not for public, but i need it to be accessible to some people). How can i add security to this website of mine?

I have search for some type of security like authentication in IIS, but i dont know what should be used. Can i just add id and password like when we try to open page for configure router (192.168.0.1) . Thanks