Email: Traps, Gotchas, and More for SME Owners

In this episode, we're taking a look at all things email — seemingly a boring topic, but beneath the surface it's very "universality" (the fact that email is used by everyone) creates some interesting ways in which we can drive innovation within our businesses. We look at Microsoft 365 and G Suite, email filling, email archiving, email security, and more.
27 May 2020
Subscribe to our podcast using your favourite podcast provider
  1. Listen on Apple Podcasts
  2. Listen on Spotify
  3. Listen on Stitcher
  4. Listen on Deezer


Hey, deserving listeners and welcome to the It’s What's Next IT podcast with me, your host Matthew Reynolds. In this edition, we're going to be looking at emails, a topic that on the face of it seems boring, but if we dig into it, we'll find there are some really interesting aspects to email for SME business owners. What makes email boring is its universality. Email is everywhere. Everyone expects to have it, and there are no other technologies in the constellation of technologies we use within our businesses that share this universal nature. In particular, email is seen as a requirement of entry into doing business. People expect to be able to email us to do business, and we expect the reverse. We're unlikely to do business with people who we can't email. The flip side to that is that email can almost operate like a to-do list that anyone else can add to, in that we can receive emails and suddenly find ourselves overburdened with work because people have emailed us and said, “Can you do this? Can you do this?” In that sense, emails are a fairly unique idea as well.

The universality then is interesting in terms of marketing. Although this isn't a marketing podcast, I like to touch on these aspects of technology as it's used in marketing because that's interesting to SME business owners. Email marketing is the only channel that we can use where we can reach everyone with marketing messages. It doesn't operate like other social media channels or advertising channels. Coming back to the more SME IT side, it's interesting in terms of security. If anyone wants to be able to deliver some piece of nefarious software to us - some malware that can cause us problems - they can use email. That's why email is such a dangerous “vector” for cybersecurity threats.

It's also interesting in terms of untapped value. We tend to keep emails within our business and just leave them there in a big pile in people's mailboxes. However, there are lots of things that we can do with email to open up the value that's in there. In this episode, we're going to look at issues related to reliability and deliverability, email security, and how we can open up some of that value.

The first thing that we're going to look at is the fact that email, because of its universality, this tells us that it needs to be really reliable. It needs to always be on and always be available. We don't want people emailing us with new opportunities and then having it bounce. We don't want to be going to look at our emails and then discovering that they're not there or that the service isn't available. Way back in the days, we used to run emails by having a server within our office that held our mail on it and people would dial into it to get their email back. Nowadays, we've moved that whole thing over to using cloud-based email. This started by having several little independent providers providing cloud-based email. So, the more forward-thinking organizations would go, “You know what? We're going to stop running our email servers ourselves, which is called on-premises, and we're going to start migrating over to the Cloud. Over time, what happened was that the two biggest providers of email services - Microsoft and Google - decided that they were going to double down and go all in, in setting up their own cloud systems.

So today we've got a situation where you've got a spectrum of behaviors where you can run your own mail servers yourself on your own machines, or you can go with what I call a tier one provider, which is Microsoft 365 Exchange on Microsoft 365 and Gmail on G suite. Or you can use these other providers in the middle. Where we find these other emails in the middle is where in particular an SME has gone out and bought a hosting service for their website and the hosting company has gone, “You know what? We can do the email as well” and the person who's bought it has gone, “This seems like a sound idea. I can put all this in one place.” This is a mistake and it's something that I strongly encourage SME owners not to do. There is no reason not to put your emails on either Microsoft 365 or on G suite. To use another provider is largely inviting problems. There is no real benefit to using these other providers. Microsoft 365 and G suite are so cheap. They aren’t inexpensive. They’re just downright cheap. There’s really no reason to use anything else. So, one of the things that we look at doing whenever we bring new customers into our business is looking at them and going, “Okay, well, you're using ‘Such and Such’ hosting company. Keep the website with them because they're in business to provide websites. They're doing this email as an add on to their customers. Let's move that email over to another service.”

Once your email's in the Cloud, then you've fixed the reliability problem. Microsoft services never go down. Google services never go down. They never lose email. The emails are completely secure and safe. We're going to talk about security in a moment. The only wrinkle you need to deal with the fact is that this service becomes your crown jewels. The universality of it, and the fact that all your emails are there, and everything gets tied into that. You largely can’t email anyone or recover passwords or create your accounts without access to your email. So, one of the things that I recommend is that as a small business owner, you make sure that you've got the details of your domain - your or - you've got those details in a master account either for Microsoft 365 or G suite, depending on what you use and that they're printed out and stored in a fireproof deed box at one of the director's houses. Now, the reason for this is if everything goes to custard, you know where it is. You can't lose a multi-kilogram, heavy box of metal in your house. If you need it in a hurry, it's there. There is the advantage if God forbid the fact the house burns down then you've got that protection there in having it in a fireproof safe, and you can get these things for 40, 50 pounds. Again, they're not expensive, but that becomes a good place to put all of these bits and pieces where if you have that disaster or that emergency, you can go there.

Another quick point on this is people will often say to me, “Well, should I use Microsoft 365 or should I use G suite?” Up until very recently, I used to take a fairly noncommittal view to this because my position tends to be that in any market we look at, there tends to be a Coca-Cola choice and there tends to be a Pepsi choice. If you're selecting from a market, if you choose Coke or Pepsi, both of those are going to win. You're going to get your delicious Cola-based beverage. It’s really the other Happy Shopper Cola kind of brands that you need to be a little bit concerned about. In terms of whether you choose Microsoft 365 or G suite, I now am more positioning Microsoft 365 because everyone needs Office. You end up in this problem where even if you can actually do a pretty decent job with Gmail and G Suite, the fact that you need office suggests why not lump all that stuff over into one basket. If you're starting a new organization, definitely something I recommend actually just go all-in with Microsoft 365. If you've got an organization where you've already got G suite, but you have Microsoft 365 licenses, that's not a disastrous outcome, but over time, maybe it is something that you want to try and consolidate onto Microsoft 365.

In terms of security, what we're really trying to do is make sure that we are the only ones who can see our email. The email obviously contains a huge amount of information, which is confidential to our business and stuff that we need to keep private. To an extent, if you think about it - we'll come on to this when we talk about value - most of your communication into and out of your business is over email and therefore represented in text. So, it's really important that we make sure that our emails are only available to us. We've also just gone on and said that we should be putting our emails in the Cloud. That creates something of a dichotomy in that we have to manage security up to the Cloud. The way to do this is to make sure that you're using very strong passwords. You're using a password manager such as LastPass, and you're not reusing passwords across sites. These are all basic cybersecurity, hygiene things. Once you’ve got that down then you're pretty much okay. Then it’s just a case of don't go around sharing passwords. Don't give those passwords to anyone. If someone needs to get access to your email, then find a different way of giving them just access to the emails that they need rather than them logging into your mailbox. Also, turning on passwords and two-factor authentication on whichever service you're using is obviously key. This is where when you log in the provider will text you a code to your phone, which you have to key in, in order to get access to your service.

The second point on this is the risk vector - you could lose the device that your emails are on. Your emails are in the cloud, but a copy of your emails is on your laptop or your desktop and you could lose those. So again, it becomes important that your laptop and any [ING 00:08:49] devices that you use are encrypted. Encrypted means that the information on the disc is scrambled and can't read by anyone. If you find a laptop lying around on the street and it's not encrypted, anyone can take the disc out of that, put the disc into another computer, and read all that information off without any problems. Encryption just makes sure that you can't do that. Laptops and desktops by default aren't encrypted. You need to go through some special steps to get that encrypted. Smartphones are encrypted by default, providing that you put a lock on them. Whether that's a pin lock, face lock or password lock, once you do that, the encryption becomes active on that device.

There are two more things we need to touch on in security. One is that people don't fully appreciate that email mailboxes, as they sit in the Cloud can be modified. You could go into someone's inbox and delete all the emails. You can even go and find an email and modify it in some way. As such, one of the things that I'm really keen to recommend to people that I work with is that they have a Cloud to Cloud backup system. This works by having a service and the two that I like are Backupify and Spanning Backup. They will take your entire Microsoft 365 organization or your G suite organization and make a nightly backup as if you were plugging a USB drive into a laptop and copying the stuff off on a nightly basis. That can be a massive advantage and the price is relatively cheap. It’s like two or three pounds a month per user. That is something I absolutely recommend people do. It's something that I do, and have been doing for a very, very long time.

The final issue to do with emails and security is the fact that because of the universality of email, if anybody wants to get some sort of infection into your business, which is a slightly awkward phrase to use it at the current time, but if someone wants to get malware onto your machine or some ransomware onto your machine, email is such a great vector for that because it's so universal and it's so cheap. So, a hacker can send millions of emails, hit every individual, touch every company within the UK for literal pennies and by creating emails that have either got attachments in them which will compromise your computer if you open them or links if you click on them, it'll compromise your computer, that's really a vector that they use. It's really important that you create a culture within the business where you teach people not to trust emails. That it's not going to be a problem if a customer gets annoyed because you had an employee who was wary about opening an email. You need to protect your business and your business is effectively your customer's data as well. This is something that you can join up end to end and say, “This hygiene measure we've got in place in the business that people are very wary about emails, keeps us all safe, improves our uptime, keeps us all much more available.” That issue is absolutely key.

The last thing I wanted to look at when we talk about email is this idea about how we can get some value out of the emails that we hold. We know that we're receiving emails all the time, we're sending emails all the time, and those emails contain a lot of information. As I mentioned before, it probably is the core of most of the information flowing in and flowing out of our business. From an IT consultant’s perspective, I know that when we see information, we see data, we see the ability to make data-driven decisions and we see the ability to get some value from that. However, most people look at emails as something that just sits there in people's inboxes or maybe get filed neatly into customer folders if that's how you work. What we want to try to do is bring some of that value out.

A key thing that we can do when we're looking at the email value, is we can put the emails actually within our CRM, our Customer Relationship Management system. The CRM, for those who don't know, is a central database of all of the interactions that we've ever had with a customer. It tracks the customer from the point when we first identify them as a prospect, through the sales process, to closing the contract, through all of the operational stuff we have to do with them while they're a customer of ours through to retirement when they stopped being a customer. A lot of people within small businesses don't fully understand how to get a lot of value out of CRM. One thing you can do to get a lot of value out is to attach all the communications you have with customers within that CRM. What that lets you do is it lets you or anyone else in the business say, “I wonder what email, what communication we've had. What have we said to that customer? What have they said to us?” Because the emails are now not in people's inboxes where no one can really do anything interesting with them and those emails are in the CRM, we're able to go, “Yeah, you know what? We know that we spoke to John or we know that we spoke to Flo and we know that this is what was said, or this is what's going to happen” and anyone in the organization can bring that out. That's the very first point in that by attaching the emails to the narrative of the work we're doing with the customer, it unlocks the value. We know what's there. Other things that we can do, which are a bit more sophisticated and probably beyond the scope of this podcast is we can actually start looking at some of the textural information in there. Start doing things like measuring sentiments. Start being able to detect when customers are asking for certain things. All this kind of big data and machine learning stuff.

The final point I want to look at when we're looking at value is this idea of email archiving. To come back to this point that we touched on in security, in that mailboxes aren't what we call immutable. The data in them can be changed. We can delete and we can change data that's in a mailbox. Also looking at the idea that there is so much value in these emails. There's so much communicative intent and so many promises get made over email. What we want to be able to do is make sure that we're creating a central source of what the truth is - what the customer said to us, what we said to a customer or a supplier, a partner, an employee - but not losing emails and not having emails changed. The way that we solve this is by having an email archive. The purpose of an email archive is it takes a copy of every email that comes into the business, a copy of every email that goes out of the business, and puts it into a database that only the directors or other senior people within your organization have access to. This means that if you ever get into a dispute, you absolutely know, and all your lawyers and anyone supporting you in this dispute, absolutely know what was said to whom and when. To be completely honest with you, it has saved my bacon a couple of times over the past 20 years and it’s well worth having. Email archiving is something I absolutely recommend that people have, but it is very unusual to find it out there within the community of SME business owners, you don't often see them.

That's it for today. Thank you very much for listening to my podcast on IT Issues for SME owners. Please subscribe to the podcast for more updates, they’re updated weekly. You can also find more information on our website at On there you can find blogs and events and webinars and long-form white papers and all sorts of other things that I put out there in the community to support SME business owners. Thanks very much and take care.