SOAP Errors

What is the SOAP standard for handling errors.  Let say I implement PKI
security for my SOAP Web Service and someone sends a message that fails
security.  Do I reply with an error letting them know this or simply
discard the message?

Obviously both have merits and pitfalls.  The biggest concern I have is
someone flooding my webservice with invalid requests and having to reply to
each request.

What is the industry standard for these situations?

You can read messages from the SOAP archive, unsubscribe from SOAP, or subscribe to other
DevelopMentor lists at http://discuss.develop.com.