Hi,
I have been looking around for some help on this topic as my .Net application used to connect to a DB for which the password was being supplied in plain text in the config file under the connectionStrings section of my application configuration file.
I was looking for a mechanism to get my password encrypted which I would store on the app.config file which will then be read and decrypted by my application.
On googling I found an option that was much better then this. With this option I could still save my settings in the plain text in the app.config file and this gets encrypted on the first run of the application(provided you write the encryption code at the right place- typically in the OnStart event handler of the application).
I wrote the following function and called it from within the OnStart event handler of my app with the config section name as a parameter("connectionStrings" in my case):
private void ProtectConfigSection(String sectionName)
{
   Configuration config = ConfigurationManager.OpenExeConfiguration(Configur ationUserLevel.None);
   ConfigurationSection section = config.GetSection(sectionName);
   if (section != null)
   {
    if (!section.SectionInformation.IsProtected)
    {
     if (!section.ElementInformation.IsLocked)
     {
       section.SectionInformation.ProtectSection("DataPro tectionConfigurationProvider");
       section.SectionInformation.ForceSave = true;
       config.Save(ConfigurationSaveMode.Full);
     }
    }
   }
 }

This mechanism is based on protecting/Encrypting a particular section of the config file.
I found this approach useful as it protects my "connectionString" section by encrypting it on the first run. The best part is that I need not write any additional code for decrypting/unprotecting the config section. My app was able to read the encrypted section the same way as earlier(i.e. by using ConfigurationManager.AppSettings["Keyname"])

Hope this will be of some use. Please let me know if someone has any better approach then this.

Perhaps a silly question but...

Why the concern for security on a configuration file that is only readable on a web server? By default, IIS will not serve a .config file and presumably if you can get onto the web server itself to read the "physical" file, then you have a larger security concern.

-Peter
compiledthoughts.com