Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an organization that size, they likely use some sort of Exchange or OWA service. I was curious how data that was related to email accounts was stored locally. It appears that the data is stored in an OST file at the following location for our network.


This document appears to be unencrypted, however, it is reliant on the user or admin credentials to access the file location. Microsoft recommends using EFS for encrypting files, such as this, to protect it's contents. The problem with EFS is a large scale deployment of a company Sony's size would make this difficult to complete a roll-out due to the complexity of creating individual certificates and storage locations for each individual user. Without using EFS, are there easier to implement solutions that incorporate into Outlook to protect User's OST files from prying eyes in the event of a major breach?

EDIT: To clarify, the data I am trying to protect is data at rest. Outlook has the option enabled for Data Encryption between Microsoft Outlook and Microsoft Exchange.

  • 2
    I hear pgp is pretty good..
    – KDEx
    Commented Dec 23, 2014 at 19:08
  • 1
    Perhaps it's worth noting that EFS will encrypt the data at rest - If the computer is on and unlocked that data is presumably accessible and once it leaves the local file system it is not subject to encryption.
    Commented Dec 23, 2014 at 20:59
  • This is an opinion based question seeking recommendations. Commented Jun 16, 2016 at 9:53

1 Answer 1


Encrypting the OST wouldn't necessarily mitigate a breach. If user credentials are compromised, those could be used to decrypt an OST and whatever other files were encrypted, whether at rest or in-transit. There is no silver bullet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .