A confusing update from Rackspace

And let’s check in on that Rackspace incident.   Last week, the company pushed back on the idea that it was ProxyNotShell, saying that while the investigation is nearly complete, they do not have a definitive answer of how the threat vector came in.    

Per statements from company executives, they have restored email to more than three-quarters of its Hosted Exchange customers. 

I wanted to focus on one critical question here.   How does one know that the investigation is nearly complete, yet not have an answer to how the attack came in?     I’m happy to wait for the full report, and when it comes to an investigation, I will encourage an organization to move diligently, where accuracy is more important than speed. That’s different from restoration, of course, which should prioritize speed.

The takeaway – your messaging should be transparent and accurate.    It’s tempting to try and promise dates.    When you don’t know, don’t do that.