In IIS, you could password protect whole directories (and everything in it) simply by changing the NTFS Permissions for that folder to only allow certain users.
Of course, to use this method, you would have to have the ability to create users in Windows and edit the Windows NTFS Security for the folder(s).
Typically, if you don't have your own Windows box running IIS (i.e. a dedicated server) and/or have Administrator access to it, then this is not an option.
Ask your web host about password protecting directories if you have a shared hosting plan. Many web hosts have control panels that do the same thing as I stated above, except it does it through a control panel that you can log into via the web.