Obviously in case of a storing the connection string it has to be stored in a file. This has the further advantage that you can easily change it.A hybrid approach is that of having separate sections in the config file to store sensitive content that must be encrypted ie the connection string and must be decrypted by the application. Such an example is what .Net 2.0 does: it wraps this kind of sensitive data into <protectedData> tags inside the configuration file