Where you define the connection string really depends on your app. I agree
with Alomgir that a .config file is a pretty cool way to do it.
http://www.knowdotnet.com/articles/configfiles.html
Dino Esposito has an article titled Storing Passwords Securely is ASP.NET
pro which you can get to online. I was asked not to post links to articles
that require usernames and passwords, but if you go to ASP.NET pro's site,
you can get a trial subscription and it's a really good article.
Another way I've recently seen of handling this is buy creating a custom
attribute which is a lot more 'cool' than practical but it's worth
mentioning.
All in all though, I'd encrypt the string, stick it in a config file like
Alomgir mentions and just decrypt it before use. This gives you security
and convenience ...
HTH,
Bill