David Hayden has a great article titled “Encrypt Connection Strings AppSettings and Web.Config in ASP.NET 2.0 - Security Best Practices “.
From the article:
There are no more excuses in .NET 2.0 as to why you haven't encrypted sensitive information, such as connection strings, in your Web.config.