Currently in one of my projects, the anonymous users have access to the media library items. Meaning that if they navigate to a link similar to the following, they can see and download the file. Is it a way to secure it and force the users to login first and then be able to see/download it?
https://{host}/-/media/{images}/{myfile}.jpg?h=100&w=100&hash={hash_value}
Sitecore media items are items just like content items so you can set security on them. If you do that in the domain used by your website (most likely extranet) this will affect your users and their ability to access the media.
You can read all about the security rights here: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/the-access-rights.html Best way to remove access is to break the inheritance - in your case for the anonymous user.
ps: for media items you also need to consider the cache headers you are sending. If the media items may be cached or even placed on a CDN that might interfere with your security.