In order to accomplish this (aside from making sure that you've authenticated your users some how) is to setup an Authorization section inside of the web.config file within the directories in question that specify the permitted or denied users.
Take a look at this article which will walk you through it.
Also, for future reference, this forum is less geared towards ASP.NET than the ASP.NET ones are and you may want to direct these sorts of questions there instead in future.