Hunting for best practices info on creating custom exceptions, I came across a post titled Systems.Exception and System.ApplicationException. I found the article pretty useful, but the comments were even more enlightening.
I was hunting for information on security settings in web.config files when I came across this link. I had no idea you could pull external files into web.config. The first part of the article has a decent example for dealing with connection strings.