Script 19
Hello and welcome to Your Operations Solved, for Tuesday, may 11th, 2021
I'm your host, Channing Norton, of PC Solutions, and this is the 19th episode of our show,
Listen to us Tuesdays, Wednesdays, and Thursdays, or on our Saturday compilation episodes. If you find the show helpful or informative, please do give it a like on your platform of choice, or share it to someone else who might also enjoy it.
With that out of the way, let's get started on today's headline.
Google has announced that 2FA by default will be rolled out to google consumer accounts over the coming weeks. Even for accounts that already exist. If 2 factor CAN be enabled, it WILL be enabled.
This is great news from a security perspective. A LARGE number of successful cyber attacks are able to do a large chunk of their damage due to compromising an email, and gmail, which this change affects, is by far the largest host of consumer email. While it's hard to know exactly, market research would give google a marketshare of between 30 to 70% of the personal email market by actively used mailbox count, and about 40% marketshare over the business email market. Right now, they are just forcing 2FA for consumer mailboxes, but its likely that, in the coming months, administrators of their Google Apps platform, which is used for business email, will have to specifically opt out of 2FA if they don't want it to be defaulted on there. Between these two platforms going to near universal 2FA, the internet is about to get noticeably safer. According to Verizon's 2020 cyber breach data, two thirds of successful cyber attacks against businesses leverage compromised emails. 2 Factor authentication makes compromising an email much much harder. Possible, but not without much more effort. While I don't have hard numbers to give you, I will anecdotally say that I've handled several hundred to a thousand compromised email account scenarios in my career. Of them, only a SINGLE one was on an account with 2 factor set up, despite, across the environments I've worked in, the split of people with 2FA and without was roughly 50/50. As such, this change promises to make a SUBSTANTIAL chunk, about 50% of these business cyber attacks considerably harder.
With that done, let's continue our conversation from Thursday about structuring our email system.
So, as a review, for our address types, we had standard addresses, aliases, distribution lists, and shared mailboxes. In structuring our mail system, we had 8 focuses.
Using the tools we outlined above, how can we accomplish these goals most effectively? It obviously depends on your business, and who your customers are and how they get in touch with you, but let's get an idea of what a good structure might look like.
Give every living, breathing, human in your organization an email address. I suggest first initial last name as the format, as it scales very well and is the defacto standard, but take any format you want for naming these accounts. Just standardize it. These first initial last name accounts will be primarily used for INTERNAL communications with your employees between one another, as well as administrative functions like signing up web accounts. The only cases where employee specific accounts will be external will be in high touch positions like salespeople and account managers, where, should turnover occur, you would expect to directly notify clients of their handover. As a good rule of thumb, if the person in question is issued business cards, you can expect traffic from your customers or vendors to this address.
Next, examine every external facing department or activity. These are the areas that you want to protect from turnover. As such, they should be assigned shared mailboxes, with access granted to each person who could handle such requests.
There's a few applications here. Broadly speaking, they fall into 3 categories.
Emails that you post online. For instance, the bottom of your website might list Sales@company.com, or Customersupport@company.com. Depending on the nature of this email address and the level of personalization required, you will then either respond to incoming emails by reaching out to submissions from a direct email address, like what you'd want with a sales inbox, or merely by replying, for instance with a support address.
The next application I see is for regular customer communication. For frequent touch, regular business activities, with existing clients, like a healthcare clinic scheduling appointments, a support vendor's support requests, a wholesaler's order address, or an insurance company's claim address. For these applications, customers are not expecting to get a direct inbox in response; even if they are expecting a personalized response of some sort, having that personalization in the form of an email signature or greeting will suffice.
The next use I see for mapping shared mailboxes to business activities are for use by your staff. In communicating with our customers, we all run into situations where a customer makes a request via the wrong channel or to the wrong person. Shared mailboxes are a great way to allow your staff to easily send these responses to the correct place. For instance, if you were a wholesaler, and had a customer make a complaint to the quality of a fulfilled order to your orders inbox, you could create a catchall "Account Management @ company .com" address for your orders team to forward the issue to. In this case, it's not important that your customers know about this address, but instead that the associated team has a centralized place for requests sent out of channel.
Beyond this, I do also suggest that any customer facing shared mailbox be given several aliases for likely misspellings and miscategorizinations. For instance, you might have both Sales @ company dot com and Sale @ company dot com going to the same place to make sure that that inbox doesn't miss any messages with mistyped or misheard addresses
We now have made great progress in curbing the chaos of handling messages for our customers, but what about other types of messages?
By far, the biggest offender here are vendor sales emails. At least in my field, if I reach out to a vendor ONCE, to get their pricing or demo their product, they will continue emailing me for months or YEARS later, and unsubscribe requests are not always honored, certainly not to the extent they are with more public mass email lists. Similarly, even the vendors I USE give me a lot of emails. Bills, update announcements, new products, sales pitches to step up to a higher pricing plan on what I use,and so SO much more. For this I like using shared mailboxes as spamtraps. When I want to sign up for something that will put me on a vendors mailing list, it goes to an inbox dedicated to that. I actually have several divided by purpose. Combined with a number of inbox rules, vendor spam is largely easy to tame, even if setting up the rules can be a touch time consuming and arduous.
Before we finish for today, let's touch again on internal communications, and a use case for one of the tools we've largely ignored so far; distribution lists. Largely speaking, I would argue that most of what a distribution list does, a shared mailbox does better. However, there are some exceptions here. The biggest is departmental distribution lists intended to allow people to easily send announcements to an entire department or workgroup. This would not be the place to send work to that workgroup, that would be their shared mailbox, but instead to alert everyone on that list of say, a procedural change. Functionally, if something is in your personal inbox, you are responsible for it. If its in your departmental shared mailbox, it is the responsibility of the department as a whole to ensure a single person within the department handles the matter. This allows ascribing responsibility for each message. The end result is that managers and employees from other workgroups have the toolset to ensure that information that needs to be distributed within your organization is sent to exactly who needs to see it, and that responsibility for handling or addressing that communication is clearly determined by the sender.
There's still a bit more to this conversation, so join us tomorrow for the last third of perfecting your email system.
That's our show for today, thank you so much for listening. Tomorrow, join us for ___XXX___. In the meantime, check us out on the web at www.YourOperationsSolved.com, where you can join our newsletter, and opt to be notified of all our uploads. I will see you next time.