Monitor emails sent by 'Share using outlook' functionality in Windows using DLP

Products

• Data Loss Prevention

Issue/Introduction

You have enabled outlook channel on Symantec DLP agent and have a policy to block all attachments. This policy works successfully when attempting to send an attachment via outlook application.

Using Phone Link application, you have registered Gmail as an option in the 'Share with' functionality on Windows. You now are able to share files as an attachment and send the attachment via email through this option, in spite of DLP rule to block file attachments.

 

 

Environment

DLP 16.x

DLP 25.1

Cause

The 'Share using outlook' option does not actually launch outlook and Symantec Outlook add-in is not loaded. The email is not actually sent via outlook application.

Resolution

This behavior is expected. 'Share using Outlook' does not use 'Outlook' channel in the agent configuration.

Additional Information

You may consider using group policy to block the 'Share using outlook' feature on Windows OS.