Emailing Encrypted files with an attached unencrypted file falsely triggers an incident

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

In Symantec Data Loss Prevention Endpoint Prevent there is a policy is set to create an incident on any document being sent that is unencrypted.

When you email an encrypted xls file that contains an unencrypted attachment, an incident is created stating that the file is not encrypted

Environment

Observed in Release: 15.1, & 15.5 MP2, but is likely to occur on any version.

Component :

Cause

The older xls file format keeps large chunks of metadata unencrypted and DLP picks up on this

Resolution

Use the newer xlsx file format which will fully encrypt the entire document and its contents.