Better email management for small businesses.

Your Operations Solved

Hello and welcome to Your Operations Solved, for Thursday, May 6th, 2021

I'm your host, Channing Norton, of PC Solutions, and this is the 18th episode of our show,
Listen to us Tuesdays, Wednesdays, and Thursdays. If you find the show helpful or informative, please do give it a like on your platform of choice, or share it to someone else who might also enjoy it.

With that out of the way, let's get started on today's headlines

First, an update to a prior story. On our eleventh episode, entitled "China's Changes, and Supercharging your Sales Engine," we discussed China flexing it's political muscles to reduce the independence with which its Tech Giants such as Tencent and Alibaba were able to operate. The CCP regime has again made its will known via the Bank of China, which has released new guidance in how companies within the country are expected to operate. While a slew of changes were introduced, the most sizable are in regards to curbing the activity of epayment apps like Tencent's WeChatPay, and Alibaba's AliPay, equivalents in function to Venmo or CashApp. As per our previous reporting, we can expect the Chinese tech titans to focus more on the Chinese market rather than external markets, which may cause supply chain interruption, but also clears the field for others in their niches.

With that out of the way, let's move onto our main story,

, another big data breach.

I'm beginning to think that we need to have a dedicated podcast section for important data breaches, cyber attacks, and compromised supply chains. It seems that it's almost half of the news we cover here. Regardless, a product called "Pulse Connect Secure VPN," used by primarily large networks, has been confirmed to be compromised by a major security flaw. Worse yet, the US CyberSecurity and Infrastructure Security Agency has confirmed that Chinese affiliated state actors have been utilizing the flaw for at least a month, and has compromised at least 5 known US agencies, though CISA did not indicate WHICH agencies were compromised in their press release. If pulse secure connect is in use on your network, there is a tool available, the pulse connect secure integrity tool, to plug the hole that this vulnerability in your network represents. That being said, most small businesses will not be *directly* affected. What's far more concerning about this particular breach is the fact that we have confirmed exploitation of US government agencies. This is, to say the least, scary. With over a month of uncontested access, we could see this turn into an incident as large or larger than the 2013 OPM hack, which, to this day, remains one of the most damaging cyberattacks on record because of the volume and detail of the information that was compromised. In that case, it was full security clearance background checks for anyone who had requested a background check since the switch to computers for OPM, affecting government employees, contractors, and private industry employees in the defense sector.
Right now, as a small business, beyond a check to confirm that you don't use this product, there's not a whole lot you need to do directly, but I imagine, as more details are released on what entities were successfully compromised by the attackers and what data was exfiltrated comes out, that's sure to change, so I'll keep you posted.

With that done, let's talk about today's solution, improving email flow in small businesses.

So, let's start by exploring what email looks like for a lot of organizations in the 5-25 person size range. I typically see one of two options. One, typically present in low turnover organizations, is the simple, personalized system. Either First Initial lastname @ company.com or firstname @company.com. Everybody gets their own mailbox, and, when people leave, mail is either forwarded, checked by another employee, or simply ignored, possibly with an out of office responder set to notify people of the employee taking over the persons responsibilities. There are significant benefits with this system. Namely, customers feel more attached with the personal touch of reaching out to individual reps, and everyone has a clear scope of what mail is their responsibility and what isn't. There are, however, some downsides. Turnover for customers can be very jarring. I've set a lot of autoresponders on these types of mailboxes for people who have left a place of employment, and the only one that ever seemed to me like it would be pleasent to get from an inbox was one to the effect of "After 15 years of service, Beth has retired, we wish her the best in her endeavors going forward." The other side of this is some people will not get the message. Indeed, I can recall, in the months after setting that autoresponder, I myself hit it at least twice... There were two Beths at the company, and the person in charge of triaging tickets at the tech support company I was working for at the time occasionally put the retired Beth in as the affected user. Finally, this system makes your turnover more visible to your clients and customers, which, while a natural part of doing business, is needless to say, not something we like advertising.

The other main approach I see is departmental email addresses.

Sales @ company.com
orders @ company.com
Accounting @ company.com
and what have you. There's also typically a few people such as the business owner and veteran employees, who are grandfathered in from before this system is in place, as the former is kinda the default.
These mailboxes are usually staffed by a single person, but occasionally I do see multiple people assigned. These have the benefit of helping you scale up your operation easier, as these department names can easily be scaled from one person to two to five, without much customer impact. The downside is that interacting with a mailbox called "Account management" is a bit... machinelike, and would not, at least for me, be an ideal customer experience. Furthermore, this can cause in-office communications to be a touch hindered, especially in smaller organizations with less clearly defined roles. You run into questions like? Who is accounting again? Is it stacey, or is it Clark? I think Clark is accounts receivable. This is not ideal, and can impact efficiency and ease of communications for employees and customers alike.

So, how do we fix this? Let's start by estabilishing what our goals for an ideal system are, so that we can better figure out how to get there.

1. A good email system should leave you open for growth.
2. A good email system should reduce the exposure of turnover to customers.
3. A good email system should allow for customers to feel they are having personal interactions when necessary
4. A good email system should provide a framework for clear internal communication.
5. A good email system should allow your employees to easily identify what mail they are responsible for
6. A good email system should be as free of spam and phishing emails as reasonably possible.
7. A good email system should allow segregation of mail by type and purpose.
8. A good email system should not allow messages sent to former employees and addresses to go unnoticed.

So, What does this look like in practice. Well, let's examine the tools we have available. First, we have standard email addresses. From a formal perspective, these are addresses that can be directly logged into, and can send and receive mail. Ideally, in your organization, you should have a ONE TO ONE mapping of employees that need any kind of email access at all, and these accounts. Next, we have distribution lists. These are the lists you might see that are, for instance, "[e-mail]." They don't hold any mail themselves, but instead forward out any mail received to a preset list of addresses, such as an all company email list. These can be configured to accept mail either form anywhere, or only from your internal emails. After that, we have Aliases. Aliases are not themselves email accounts, but allow a single email destination to be accessed via more than one addressed. For instance, you might have an employee that gets married, and changes their name, and set them up to be able to receive mail both at their old address, and their new name, without there being any difference in the way the mail gets treated. Finally, we have the crown jewel of email management, in my opinion. The Shared Mailbox. Not all email hosts have this feature, but the three main enterprise email solutions, Microsoft Exchange, Microsoft 365, and Google Apps for Business, all do, in various names. A shared mailbox can be thought of as a PO box wherein the key may be given to multiple people. Nobody can log into the mailbox directly, much like how nobody lives at their PO box, but anyone with permission can see and access the mail in the shared mailbox, and manage it just like it was in their own account. Unlike a distribution list, however, where mail gets copied to each persons inbox, in a shared mailbox, actions are, well, shared. There's only one copy of the message. If someone marks it as read, or replies to it, or moves it to a different folder, these actions are reflected for EVERYBODY with access. Also differentiating it from the distribution list is that messages can be sent FROM them, without revealing the email address used to access it.

These tools should give you some inklings for how to look at improving your mailflow, but there's quite a bit more to making our email flow as painless as possible. More than I could cover in a single episode, as I realized when this script reached about 60% longer than my target length, and I was still typing. That's our show for today, thank you so much for listening. Check us out on our tuesday episode next week where we move from theory to application, and show how we should utilize these tools to make our business communications smoother. In the meantime, check us out on the web at www.YourOperationsSolved.com, where you can join our newsletter, and opt to be notified of all our uploads. I will see you next time.

Tomorrow, join us for ___XXX___.

With these tools in mind, how should we structure our email, and solve common email problems?

Well, I would suggest, 1.
Give every living, breathing, human in your organization an email address. I suggest first initial last name as the format, as it scales very well and is the defacto standard, but take any format you want for naming these accounts. Just standardize it. These first initial last name accounts will be primarily used for INTERNAL communications with your employees between one another. The only cases where these will be external will be in high touch positions like salespeople and account managers, where, should turnover occur, you would expect to directly notify clients of their handover. As a good rule of thumb, if the person in question is issued business cards, you can expect external traffic to this address. Otherwise, it will mostly be used for internal purposes, and to grant access to other addresses like shared mailboxes.

Next, examine every external facing department or activity. These are the areas that you want to protect from turnover. As such, they should be assigned shared mailboxes, with access granted to each person who could handle such requests. Direct your customers to this location. This includes areas which you want the personal touch of customers using individual people's addresses. This is so that you have a central location for "Catch all" requests, such as for posting a sales email inbox online. It also gives your employees in other departments a central place to email that department. Let's look at this in the context of PC Solutions, and see how we handle things. PC Solutions is an IT support firm. As such, our customers need the ability to submit tickets, potential customers need the ability to request information, and technicians need to be able to direct requests that should go to account managers that came into the technical support queue to the account management team. Here we have the three main use cases for these shared mailboxes.
First, our routine business operations with our customers go to the ticketing address. For other companies, this might be an "Orders" address, or the like.
That's our show for today, thank you so much for listening. Tomorrow, join us for ___XXX___. In the meantime, check us out on the web at www.YourOperationsSolved.com, where you can join our newsletter, and opt to be notified of all our uploads. I will see you next time.