A Security Engineer’s Nightmare

You notice weird alerts in your environment and start to investigate them. As you’re digging into the myriad of log and monitoring data, you realize what you’re looking at is a telltale sign of data exfiltration — you’ve had a breach, so you follow the trail and realize the breach started before the earliest retention date of your log data. You have no way of forensically proving when the breach started or even the true scope of the breach. Adding to your distress is the growing number of data privacy laws that are requiring breach notification – as of this writing, the EU’s General Data Privacy Regulation (GDPR) requires notifications to potential victims of breaches within 72 hours of the discovery of the breach.