We recently had a vendor demo demonstrating an attack that is just as easy as MITM. Once attached directly to the server, he was able to then display the sa password. Apparently SQL server keeps the SA password in clear text in memory. If somebody logs on with the SA, it will stay there in memory - even after the connection is closed. Combine this with a MITM attack, and you have no data left to protect.