Can someone with more experience of these things tell me how these breaches are discovered, and how they know what information was taken? I presume it's not an exact science.
Not overly experienced with this, but years ago we used to add honeypot email addresses to our databases for a super simple & cheap way to at least get an idea of whether data had been exfiltrated. If you add a new email once a month you can get some 'timing' info, and then could start comparing against logs.
that's actually pretty clever!
I assume some logs show anomalies but I bet a lot of breaches never get discovered. Just noticing a breach probably requires some good practices,
yeah, if you're absolutely inept and have insufficient logging/monitoring, you can't even tell how bad you'd been screwed. kinda like a Dunning Kruger effect of sorts
Some execs also think it's better not to know because they think they won't be responsible then. I have seen this with managers opposing pen testing because they were worried about the consequences of finding vulnerabilities.