Data Loss Prevention

 View Only
Back to discussions
Expand all | Collapse all

DLP Detected PCI card number, which cannot be found in powerpoint file

  • 1.  DLP Detected PCI card number, which cannot be found in powerpoint file

    Posted Jan 12, 2017 07:35 AM

    Hi All,


    DLP Discover has detected 2 PCI card data matches in a PowerPoint document. But when I manually search for that number in the document it is not found.

    The match as it is in the DLP incident as follows:

    ".tatement of Account 5xxxxxxxxxxxxx58 repairernetworkmana...

    ...tatement of Account 55xxxxxxxxxxx61 af@xxxxxxxxx"

     

    I've done some googling to find out how to review hidden data in office documents but not come up with much, only using the "Inspect Document" feature which you can then remove meta data and XML data etc..

    So i've removed as much as i can using that feature and also broke all links to spreadsheets in the "Edit Links to files" option. But each time i scan the document it always see the above Matches.

    There are many spreadsheet tables in the PowerPoint document but I've manually checked them and I can see nothing like that numbers listed above.

    I've also renamed the PPTX file as XML and open it up in IE and Chrome and then searched that data for the number and that has found nothing as well.

    If anyone knows of any resource which provides handy hints into querying office documents to read it's raw data I'd be grateful.

    Thanks