One possibility would be to use INTEGRATED SECURITY=sspi in your connection string, like this you don't have to specify user/password and access would be handled through Active Directory login and DB permissions (you'd need to setup DB access for allowed users for this to work).
I also found this other article on Stack Overflowarticle on Stack Overflow where they explain how to create an external DLL that can be used to retrieve the connection object obscuring all details in that compiled library.