Prove that a Breach Didn't Result in a Leak

Question

I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access auditing enabled, one can prove that no sensitive has leaked, and therefore, customers need not be notified.

But I don't buy it. How can anyone prove after the fact that no data was read without any auditing? Any data read could easily be scrambled on its way out, so network logs don't necessarily prove anything. Furthermore, any touched file can easily have its timestamp reversed, not to mention that there's no way to tell who precisely last read the file (e.g. was it the true root user or the hacker as root.)

As far as I know, there's no way to prove what's been seen during a breach unless there's something auditing the file system at all times, and therefore, it's an obligation for companies to notify their clients that they were hacked if a system that contains sensitive data is ever breached.

Answer 1

Forensic analysis can be conducted, even without auditing on the filesystem, to determine file access and piece together the potential scope of a breach. Basically all filesystems in use on modern computers are journaling file systems, which contain a sort of circular log trail. Using tools to read deleted/overwritten disk sectors, one can begin to see what files were accessed when. If no sensitive files were accessed during the time of a breach, a forensic security analyst might be opt to declare the breach did not result in release of sensitive data.

However, as you point out; these forensic methods may not conclusively determine the extent of a breach. Your stance is definitely the more conservative and realistic option.

Companies will spend a lot of money on forensic security analysts and push them to declare (this forensic evidence being admissible in Court, at least in the USA, if done properly) the breach didn't release sensitive data in order to dodge reporting requirements.

Answer 2

Faraz you are correct from the perspective of a security professional. However as Herringbone_Cat noted, from management perspective, you want to contain the damage as much as possible. If no data has been leaked then you would like to keep the breach quiet as not to damage company reputation; especially if you are publicly traded because it could cost millions.

If you are going forward in the field of security always keep in mind that information security's goal is add business value.