Is it possible to detect a picture image (jpg, etc.) embedded in a Powerpoint?

book

Article ID: 159920

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor Data Loss Prevention Network Prevent for Email Data Loss Prevention Enforce Data Loss Prevention Network Discover Data Loss Prevention Endpoint Discover

Issue/Introduction

If a Powerpoint slide has a .jpg image embedded in it, will Symantec DLP detect it?

Resolution

Relevant version:  9.x and up

Yes, Symantec DLP will detect an image using IDM and the policy is set up correctly.

NOTE:  This does NOT work with Powerpoint 1997-2003 with the PPT extension.  Use Office 2007 which creates a .PPTX and .DOCX extension.  This format is effectively XML which allows for detection. 

To test this scenario:

1. Create a single IDM profile containing a JPEG
2. Embed the same JPEG inside one each of the following:

  • a one-slide PPT
  • MS-Word doc 
  • ZIP file

*Note:  .PDF has not been tested.  It is unknown whether this will work.

3. Partial matching of any binary content (such as images) is not possible. It will always be an exact binary content hash-based match regardless of the percentage set in the policy.

This is not an exhaustive test and may need some tweaking.  In addition, you can double check this test by modifying the original JPEG (more than 20%) and see if the policy generates an incident at 20% (it should not if the test is successful).