Cybersecurity Services for Small Businesses in Central Oregon
A layered security baseline sized for a small business: the protections that stop the attacks small offices actually see, rolled out in a sensible order, explained in plain English, and kept up month after month.
Think you've been hacked? Text us now, client or not, and we'll tell you what to do next.
Small businesses get attacked through ordinary things
Most break-ins at small businesses don't start with anything clever. They start with a stolen email password, a convincing fake invoice, a laptop that missed months of updates, or a staff account that has admin rights it never needed. The fix isn't one expensive product. It's a set of ordinary controls, layered so that when one fails, the next one catches it.
That's what we build. Our team in Redmond sets up and manages security for offices across Central Oregon, from Bend and Redmond to Prineville, Sisters and Madras, and we explain every piece in terms of what it protects you from.
The layered baseline
These are the controls we work toward with managed clients. Each one covers a different way in, and the specific tools depend on your setup and licensing.
Phishing-resistant MFA
Multi-factor sign-in on email, remote access and every admin account. Where we can, we move people to passkeys, FIDO2 security keys or Windows Hello for Business, which a fake login page can't capture the way it can a texted code or an approval prompt.
Email security
Filtering for phishing and malware, plus SPF, DKIM and DMARC on your domain so criminals have a harder time sending mail that looks like it came from you, and your real mail is more likely to land in the inbox.
Patching
Windows, Mac, browser and common app updates applied on a schedule, with reporting so we can see which machines are behind and why. Devices that can no longer get security updates go on the replacement plan.
Endpoint protection and EDR
Antivirus alone looks for known bad files. Endpoint detection and response (EDR) tools, for example, watch for suspicious behavior, like a program encrypting files or a new admin account appearing, and can isolate a machine.
Backups with tested restores
Copies of your servers, PCs and cloud data kept offsite and separate from your everyday accounts, so ransomware can't reach them. We test restores, because a backup you've never restored is a guess.
Least privilege
Nobody works day to day as an administrator. Admin rights live on separate accounts used only when needed, and staff get access to the folders and apps their job requires, not everything.
Security awareness training
Short training, plus tools such as simulated phishing emails, so staff learn what a fake invoice or password-reset email looks like, and know to report it instead of hiding it.
Device encryption
Full-disk encryption, for example BitLocker on Windows and FileVault on Mac, so a laptop left in a truck or stolen from a car is a hardware loss, not a data breach.
Microsoft 365 hardening
Security defaults at minimum. With Business Premium, tools such as Conditional Access policies that block risky sign-ins, require compliant devices and stop legacy sign-in methods that skip MFA.
Firewall and Wi-Fi segmentation
A business firewall that's updated and monitored, and separate networks for staff, guests, cameras and other smart devices, so a guest phone or a cheap camera can't see your file server.
How we assess and roll it out
Turning everything on at once breaks things and annoys staff. We go in an order that cuts the most risk first.
- Assessment. We review your Microsoft 365 or Google Workspace settings, admin accounts, devices, backups, firewall and Wi-Fi. You get a one-page plain-English summary of what's fine and what needs fixing, ranked by risk.
- Quick wins first. Usually MFA on every account, removing daily admin rights, and confirming backups exist and restore. These close the most common doors.
- Devices and email. Endpoint protection (for example an EDR tool), patching, encryption and email authentication records, rolled out with a heads-up to staff about what will change.
- Policies and network. Sign-in policies (for example Conditional Access) where your licensing supports it, Wi-Fi segmentation and firewall cleanup, scheduled around your business.
- Ongoing. Monitoring, monthly patching, phishing training and quarterly check-ins where we review what's changed and what's next.
If you need proof of these controls for an insurer, a client or an auditor, see cyber insurance readiness and security assessments.
When something goes wrong
If you suspect ransomware, a compromised mailbox or a fraudulent payment, the first hour matters. A few rules we give every client:
- Disconnect the affected computer from the network (unplug the cable, turn off Wi-Fi). Don't power it off, because that can destroy evidence investigators need.
- If you have cyber insurance, call the insurer's claim line before hiring an incident response firm. Many policies require you to use their panel vendors.
- If money moved, call your bank right away and ask them to try to recall the transfer.
- Then text us. We help contain the problem, reset accounts, restore from backup and work alongside the insurer's responders.
If personal information may have been exposed, Oregon's breach notification law (the Oregon Consumer Information Protection Act, ORS 646A.600 and following) may require you to notify people. Your insurer's counsel can tell you what applies.
Related reading
Security is part of every plan in our managed IT services in Redmond and across Central Oregon, including IT support in Bend.
Common questions
We're a five-person office. Are we really a target?
Yes, though usually not personally. Most attacks are automated: criminals send phishing emails and try stolen passwords against thousands of businesses at once and take whatever works. Small offices are often easier to get into, which is why the basics matter.
Isn't the MFA app on my phone enough?
It's much better than a password alone. But attackers now use fake login pages that pass your code or approval through in real time. Passkeys, FIDO2 keys and Windows Hello for Business are tied to the real site, so that trick doesn't work. We start with what you have and move admins and high-risk users first.
Do we need Microsoft 365 Business Premium?
Not always. Security defaults in the standard plans cover a lot. Business Premium adds Conditional Access, device management and Defender for Business, which matter more as you grow, handle sensitive data, or your insurer asks for them. We'll tell you which fits.
Will this slow my staff down?
A little at first, mostly during MFA setup. After that, most people notice very little. We roll changes out in stages and give staff a heads-up before anything changes.
Is security included in managed IT, or extra?
The baseline is part of our managed plans, which are priced per user per month and quoted after a free consultation. Larger projects, like a network rebuild, are quoted separately up front.
Find out where you stand
Book a free 30-minute consultation. We'll look at your setup and give you a one-page plain-English list of what's fine and what needs fixing, plus a quote.