If a Powerpoint slide has a .jpg image embedded in it, will Symantec DLP detect it?
Yes, Symantec DLP will detect an image using IDM and the policy is set up correctly.
NOTE: This does NOT work with Powerpoint 1997-2003 with the PPT extension. Use Office 2007 which creates a .PPTX and .DOCX extension. This format is effectively XML which allows for detection.
To test this scenario:
1. Create a single IDM profile containing a JPEG
2. Embed the same JPEG inside one each of the following:
*Note: .PDF has not been tested. It is unknown whether this will work.
3. Partial matching of any binary content (such as images) is not possible. It will always be an exact binary content hash-based match regardless of the percentage set in the policy.
This is not an exhaustive test and may need some tweaking. In addition, you can double check this test by modifying the original JPEG (more than 20%) and see if the policy generates an incident at 20% (it should not if the test is successful).