DLP fails to identify file types of blank documents created by right-click

Products

• Data Loss Prevention Core Package
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

• You have created a document by right clicking in Windows explorer and selecting an MS Office file type eg. Word
• You leave the file as it is created -  with no content
• You notice that your file type identifier policy in DLP cannot detect that the blank file is a Word document

Environment

Windows, DLP Endpoint, Network Prevent 

Cause

DLP file types are identified by the first few bytes in the file header.  When a document is created as described above, the file is 0 bytes in size so no file header exists. The operating system is using the file extension in the name to classify the document as Word in this example, but this is insufficient for a valid file type identification from DLP as it can easily be changed. 

Resolution

This is the expected behaviour and does not represent a data loss scenario.