We publish server-side application to our customer workstation and customer's security guys are concerned about configuration connection strings safety.

Connection strings are stored as plain text right now, but as configuration file is not in the public/shared folder we supposed that workstation security itself is enough.

What are the ways to improve connection strings security further?

It is a big step forward to encrypt password and keep a decryption key on the same workstation? What are the steps we can take to keep connection strings (and alike) information more and more securable?

Thank you in advance!