When you have files you wish that your local code can access but not allow external access to those files, you can use the httpHanlders. Simply add a handle such as:
<httpHandlers>
<add verb="*" path="/data/*.mdb" type="System.Web.HttpForbiddenHandler"/>
</httpHandlers>
This will block any outside access directly to any mdb files in the data directory. You can leave the path off to block external access to all mdb files.
There is one requirement though, you must have the extention mapped to aspnet_isapi.dll. The handlers will not work without the mapping. (that is the in the app configuration in IIS for the web site).