Any FAQ on how to Secure Admin properly?

This message was sent from: General Support
http://forums.oscommerce.com/viewtopic.php?p=227151#227151
----------------------------------------------------------------

I searched the forum but can't find what I am after.

What is the proper way to secure admin.  I have the admin login contribution loaded. 

Do I need to password protect the admin directory?
If yes, do I also need to force it to be https?
If yes to https, how do I force this?
If https, isn't the admin much slower?

thanks for any info