Web Service Security Patterns and Practices
The PAG guys (Jason Hogg, Don Smith) have been getting some great WSE 3.0 Security content together. I suggest that you download this and spend some time with it. It will all carry you through to WCF, so this is long term knowledge on message level security.
