How does Nhibernate support security around it connection strings in the Nhibernate config file???

NHibernate 1.2 supports ASP.NET connectionStrings element; so you can use its security features.

If you are working on a Windows application, you can manually protect the connection string (outside the config file) and provide it when building the session factory.