Eugene Spafford tells Federal News Radio that, typically, it’s impossible to tell how long a breach has been going on.