Effective Thinking Notes https://notes.51sec.org/ Collect, Organize, Think, Create Tue, 11 Aug 2026 01:43:23 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en-US All rights reserved 2026, NetSec <![CDATA[微软Azure订阅如何添加超级协助管理账号 - 如有乐享]]> https://notes.51sec.org/Learning/5f088e76-6adb-4db2-86f9-8388911c30b1 https://notes.51sec.org/Learning/5f088e76-6adb-4db2-86f9-8388911c30b1 Mon, 03 Jul 2023 00:00:00 GMT
今天折腾Azure OpenAI API，由于原绑定账号是Gmail邮箱。但是无法自动登录到Azure OpenAI Studio。所以需要换到微软账号上！
notion image
有2种方式：第一，订阅转移。第二，添加协管账号。
本文主要介绍第二个方法！本文主要是记录过程，分享一下。以备以后使用！
更多关于：Azure / OpenAI
需要Azure OpenAI？可点击这个看看

协管作用

1，(玄学）降低账号订阅被封的概率
2，超管账号被封或者忘记密码补救方案
3，某些服务必须得微软账号管理，比如OpenAI模型管理

准备工作

1，一个有效订阅的Azure
2，一个微软账号 （被邀请账号）

简要步骤

1，访问订阅详情，点击【访问控制】 - 【添加】 - 【添加角色分配】
notion image
2，角色：选择【特权管理角色】- 选择 【所有者】
notion image
3，成员：【选择成员】- 输入微软邮箱 - 选择成员
notion image
4，条件：选择允许用户分配所有角色(高特权) ，点击审阅和分配
notion image
5，稍等即可添加成功！被邀请者邮箱会收到一封邮件。点击链接确认邀请即可！
notion image
6，使用被邀请账号登录Azure控制面板，右上角头像点击 切换目录 即可！
]]> <![CDATA[Entra ID – Deep Dive – The Basics – Part 1 | Journey Of The Geek]]> https://notes.51sec.org/Collections/37efc8e8-dcfd-81f2-bae5-f5c27db9abda https://notes.51sec.org/Collections/37efc8e8-dcfd-81f2-bae5-f5c27db9abda Sun, 14 Jun 2026 00:00:00 GMT
Entra ID – Deep Dive – The Basics – Part 1
This is part of my series on Microsoft Entra ID:
Yeah… You read that right. I’m finally biting the bullet and doing a series on Entra ID. There are some cobwebs there, but once upon a time I was a half-baked “identity guy”. Nah, I’m not returning to that place, but I have had to visit it more frequently over the past few months. With the growing use of agents, identity has one again become of those things that apparently everyone is a so called “expert in”. I aint no expert, but I have been digging into the chatter around the implications of agents into the identity world. Given my employer, that has been spending some time in the Entra ID Agent Identity space.
Digging into that demanded I go back to some of the basics of Entra ID such as the purpose of an application registration versus a service principal and the request flow when authenticating a user to an application using OIDC (OpenID Connect) or executing an on-behalf-of flow in OAuth. I had conceptual knowledge of the above, but it was too ivory tower. I needed to eat the dog food and do it. After spending a few weeks reading through the documentation, reviewing captured requests and responses, reviewing RFCs, and poorly coding some applications to exercise on the concepts I figured it was time to brain dump what I learned before I get distracted with some new shiny widget and forget 60% of it.
So yeah… that’s where this series is coming from. Hopefully some folks out there draw some value out of it beyond serving as a refresher for my neural pathways.
With that rambling out of the way, let’s get to it.

WTF is Entra ID?

Many years ago when Microsoft first introduced Azure Active Directory my peers and I scratched our heads with this question. Given the name, the initial assumption was it was the Windows Active Directory “killer” (stop trying to make that happen, it aint gonna happen). That seems to have been a pretty common assumption given what I’ve heard from customers over the years as I sat in the vendor space and is likely why the name was shifted a few years back to Entra ID. Either that or marketing needed to justify their existence with another product rename.
If you want the professional explanation as to what Entra ID is you can read the public documentation and bask in the marketing mumbo jumbo. Since you’re here, you’re going to get the less fancy and quick and dirty Matt Felton explanation. My take is that Entra ID does a lot of shit, but at its core it is:
  • An identity store for the identities of human and non-human security principals, their attributes, and their credentials.
  • An authentication service which can act as an OAuth Authorization Server, OIDC identity provider, SAML IdP / SP, and even Kerberos / LDAP provider (gross)
It provides these core services to Microsoft’s cloud services such as M365, Azure, Dynamics 365, and whatever other clouds Microsoft has that I’m missing. It can be extended to provide these services to other applications by integrating with it via one of the supported protocols like we’ll see in further posts in this series.
Entra ID is divided into separate tenants which represent unique identity boundaries. Services for a given customer (such as an Azure subscription) are associated to an Entra ID tenant which acts as the identity boundary for those resources. Tenants can trust other tenants to facilitate cross tenant accessing of resources through features like Entra ID External ID.
The identity store piece of the Entra ID service is where users, groups, many types of service principals, applications, and device identities are stored. Similar to an LDAP (hell may be LDAP under the hood, who the hell knows) each of these objects has a schema with specific properties that are consumed for the other services Entra provides (as we’ll see later).
That should be enough context to give you a very general idea of what Entra ID is. Like I mentioned above, it does a lot of shit (conditional access, privileged identity management, etc) that isn’t relevant to the point of this series and that I’m not going to discuss. If you can hammer it in your head those two core functions, it will be enough to get you through this series.

Humans vs Non-Humans

Within Entra ID we have two primary objects that represent humans and non-humans. For humans we have the user identity. For non-humans we have service principals. Service principals come in many flavors including the base service principal (consider legacy), applications, managed identities, Agent Identity Blueprints, and Agent Identities (likely others I’m missing), Agent Users. The way I like to think about the many types of service principals (probably incorrect but I don’t care) is that the base service principal is the parent object class and things like managed identities, agent identity blueprints, and agent identities are children of that object class which look a bit different. Agent Users are a bit weird and I haven’t delved into them much, however, I like to think of it as a child of the base user object class.
The other object type that’s important to understand is the application object (typically referred to as the app registration). The application object is interesting (and can be confusing). It exists to represent a globally unique representation of an application. For a given application, you only ever have a single application object which exists in the tenant it was registered. What’s helped me is to think of the application object as the OAuth client registration. That’s probably not completely correct, but it helps ground you in its purpose. The application object can have a credential (secret, certificate, federated) which allows it to authenticate to Entra ID (think OAuth confidential client). It also contains information critical to OAuth such as the client id (appid), the audience (identifierUris), the OAuth scopes it supports (oauth2PermissionScopes), and redirectUris (when using interactive OAuth flows).
Below you’ll see an example of an application object for an application that is acting as a backend API to the demo solution I put together for this series.
Now comes the importance of the service principal. An application object will typically have an associated service principal (not much use without it) which acts as the security principal for the application in the given Entra ID tenant. Applications have one application object (or app registration) but many service principals (if it’s multi-tenant). Think of the service principal as the “stub” identity representing the application in the Entra ID tenant. Permissions are granted to the service principal and the application uses the service principal to exercise those permissions to do things such as querying the Microsoft Graph API.
If you build a multi-tenant application like I’ve done here, other Entra ID tenants can create a service principal for the application in their tenant allowing the application to possibly authenticate those users and access resources in that Entra ID tenant.
The official documentation likes to refer to the application object as the template for the application and the service principal as the security principal. I think that’s a pretty damn good single sentence explanation.
Below is an example of the service principal for the frontend application I built for this series. You can see the type of service principal (servicePrincipalType) in this scenario is application because this service principal has an associated application object (app registration).
Now that you have the bare bones basics of Entra, you likely want to understand how an application would go about using it for authentication and authorization. While you might not be doing this now and it may not seem relevant, it will become very relevant to you if you begin building agents in Microsoft’s clouds through Microsoft Foundry, CoPilot Studio, or the 18 other random services Microsoft allows agents to be built. This will also be relevant to you if you’re going to consume Microsoft resources (such as Azure) from other clouds through an application or an agent. So yeah, you should understand what this looks like to do. The whole Entra ID Agent Identity feature builds on these foundational pieces.
To see these concepts in action I’m going to walk through a very simplistic solution with a frontend website and backend API in Python. The frontend website is built using the Flask Framework and the backend API is built with fastapi.
notion image
Demo application architecture
The frontend website will use Entra ID to authenticate the user and will be issued an OIDC id token to identify the user. The frontend will get some information from the user from the id token and access token it receives from Entra and will make additional calls to the Microsoft Graph API using the client credentials flow to grab other attributes of the user’s identity. I’ll also show how to include the user’s Entra ID group information in the id or access token and how to handle nested group membership.
The frontend will have a link on it to call the /story endpoint of the backend API. The story endpoint will pull a pre-built AI generated story about the user which has been uploaded toblob storage in an Azure Storage Account. The backend API will use the on-behalf-of flow to access the storage account as the user to pull the user’s specific story.
This will demonstrate some of the most common flows including authentication, OAuth client credentials flow, and OAuth on-behalf-of (or jwt bearer). I’ll show you how the id tokens and access tokens look in different scenarios pointing out the relevant claims and how they’re used upstream. I’ll even share some process flows so you understand what does what in a given flow.
My primary goal here is give you the basics so you can walk away with a more solid understanding of what’s happening under the hood and how Entra ID has decided to implement OIDC and OAuth. I can’t stress how helpful this will be for you once you start diving into the agent identity space (which I’ll be covering after this series).
Ok, so you know what you’re in for. This series is gonna be relatively deep in the weeds so bring your favorite caffeinated beverage for future posts. I’m doing everything direct with the REST APIs because I want to show you the gory details. No pretty SDKs for you. If you’ve had a “conceptual” idea of how this works without the implementation specifics (like I did before I went down this rabbit hole) this series should help to fill those gaps.
In the next post I’ll walk through setting up Entra for the frontend website, authenticating a user, and exploring the id token and access token. The post following that will walk through using the application’s identity context to get more information about the user from the Microsoft Graph API such as nested group membership, then I’ll finish up the series by walking through the on-behalf-of flow with the backend API to show you how to carry the user’s identity context through the application to the destination resource down the line.
See you next post!
]]> <![CDATA[SRC漏洞思路分享：通过 OneForAll 挖掘子域，发现与修复云存储“列桶/暴露”风险]]> https://notes.51sec.org/Collections/338fc8e8-dcfd-817a-ad17-d23caf7e0a10 https://notes.51sec.org/Collections/338fc8e8-dcfd-817a-ad17-d23caf7e0a10 Fri, 01 May 2026 00:00:00 GMT
前言 / 摘要
OneForAll 是一款成熟的子域收集工具，常用于资产梳理与外部攻击面可视化。本文以介绍 OneForAll 为切入，说明如何在合规与授权前提下把子域枚举成果和云存储暴露风险（俗称“列桶/桶权限错误”）结合起来用于安全评估、风险定位与修复建议。文章避免提供任何可直接用于未授权入侵的操作细节，只给出可执行的防守性流程与披露示例，适合安全从业者、资产管理者、和运维同学参考。
https://mp.weixin.qq.com/s/4E0C6Jg1nK0Iw4ygH3gQfg

什么是 OneForAll？为什么要用它？

OneForAll 是一款面向子域收集（subdomain enumeration）的开源工具，能从多种情报源（搜索引擎、证书透明日志、被动DNS、接口类服务等）和爆破字典中汇聚子域结果。它的价值在于：
  • 帮助安全/运维团队发现被遗忘或未纳管的外部资产；
  • 为攻击面缩小与风险评估提供基础数据；
  • 可结合后续的存活验证、端口探测、接管检查等流程推进安全治理。
适用场景（正当、合规）：企业外部资产梳理、红蓝队预授权评估、应急响应时快速识别暴露接口、合规审计前的自查等。

安装与快速上手（安全且高层次）

OneForAll 项目地址（作者/仓库）：
https://github.com/shmilylty/OneForAll。
基本思路：克隆仓库 → 配置必要的 API/代理（若使用被墙的数据源）→ 运行主程序或特定模块收集子域。
举例（仅演示命令格式，请在获得资产所有者明确授权后运行）：
Image
上面是工具的常用运行形式；更多参数请通过 python oneforall.py --help 或阅读项目内 setting.py、api.py、config.py 获取最新说明。

某赏金SRC平台 从子域枚举到“云存储暴露”

Image
免责声明：本文仅提供合规防御与治理思路。任何对未授权资产的扫描、探测或利用均可能触犯法律与平台规则。若你需要对自己组织进行渗透测试或红队演练，请确保取得授权，并优先使用厂商/云原生的安全与审计工具，或与专业安全团队合作。
]]> <![CDATA[How to Install Apache Guacamole on Ubuntu 24.04 - kifarunix.com]]> https://notes.51sec.org/Collections/252fc8e8-dcfd-8101-8f53-f13807288de8 https://notes.51sec.org/Collections/252fc8e8-dcfd-8101-8f53-f13807288de8 Sat, 13 Jun 2026 00:00:00 GMT
In this guide, we are going to learn how to install Apache Guacamole on Ubuntu 24.04. Apache Guacamole is a clientless HTML5 web based remote desktop gateway which provides remote access to servers and desktops through a web browser. It supports standard protocols like VNC, RDP, and SSH.

Table of Contents

Install Apache Guacamole on Ubuntu 24.04

Guacamole is made up of two parts;
  • guacamole-server, which provides the guacd proxy and all the native, server-side components required by Guacamole to connect to remote desktops.
  • guacamole-client which provides the client to be served by the servlet container which is usually Tomcat.
You need to install both of these components to setup Apache Guacamole web-based remote desktop client.
Ensure your system package cache is up-to-date;

Check Available Version of Guacamole on Default Ubuntu Repos

Guacamole is available on the default Ubuntu 24.04 repositories. However, available version is not up-to-date;
To get the latest release version of Guacamole running on Ubuntu 24.04, you need to build it from the source.

Install Required Build Tools

To install guacamole-server, you need to build it from the source. This, therefore, requires that you need install the required build tools before you can start to build guacamole-server component;
A comprehensive description of these dependency tools is available on required dependencies section.

Building Guacamole-Server on Ubuntu 24.04

To build guacamole-server, download the latest source archive tarball from Guacamole releases page. Guacamole 1.5.5 is the latest release version as of this writing. You can simply run the command below;
Replace the value of the VER variable with the current release of Guacamole.
Once the download is done, extract the source tarball.
Navigate to guacamole server source code directory;
Run the configure script to check if any required dependency is missing and to adapt Guacamole server to your system.
Ubuntu 24.04 ships with OpenSSL 3.x and Guacamole requires openssl 1.x to successfully compile and install. The warning related to this are treated as errors and thus the compilation process will fail. As a result, you can disable the Warnings from being treated as errors and compile Guacamole on Ubuntu 24.04.
For more configure options, run, ./configure --help.
Pay attention to out of the configure script.
Compile and install Guacamole Server on Ubuntu 24.04;
Next, run the ldconfig command to create the necessary links and cache to the most recent shared libraries found in the guacamole server directory.
Start and enable guacd (Guacamole Daemon) to run on boot after the installation.
To check the status;
Apache Tomcat is used to serve guacamole client content to users that connects to guacamole server via the web browser. To install Tomcat, run the command below;
Guacamole client, as of this writing is not compatible with latest releases of Apache Tomcat and hence, still requires Apache Tomcat9.
While you can install Apache Tomcat9 by building from the source as outlines in this guide;
How to Install Tomcat 9 on Debian 12
in this guide, we will use Ubuntu 22.04 Jammy Updates universe repos to install Apache Tomcat9;
Install Ubuntu 22.04 Jammy updates universe repos on Ubuntu 24.04;
Run system update;
Install Apache Tomcat9 on Ubuntu 24.04;
Disable Ubuntu 22.04 Jammy updates universe repos and run system package cache update;
Tomcat9 is started and enabled to run on system boot upon installation.
If UFW is running, allow Tomcat through it.

Installing Guacamole Client on Ubuntu 24.04

guacamole-client contains provides web application that will serve the HTML5 Guacamole client to users that connect to your server. The web application will then connect to guacd on behalf of connected users in order to serve them any remote desktop they are authorized to access.
Create Guacamole configuration directory;
Guacamole client can be installed from a source code or from ready binary. Binary installation is used in this demo. Download Guacamole-client from Guacamole releases page for the respective latest version (v1.5.5 as of this writing) and store it in the configuration directory created above;
Create a symbolic link of the guacamole client to Tomcat webapps directory as shown below;
Restart Tomcat to deploy the new web application;
Restart guacd daemon as well;

Configure Apache Guacamole on Ubuntu 24.04

Guacamole has two major configuration files; /etc/guacamole which is referenced by the GUACAMOLE_HOME environment variable and /etc/guacamole/guacamole.properties which is the main configuration file used by Guacamole and its extensions.
There are also guacamole extensions and libraries configurations. You need to create the directories for these configs;
Set the guacamole home directory environment variable and add it to /etc/default/tomcat9 configuration file.
To define how Guacamole connects to guacd, create the guacamole.properties file under /etc/guacamole directory with the following content.
After that, save the configuration file and link the Guacamole configurations directory to Tomcat servlet directory as shown below.
Guacamole’s default authentication method reads all users and connections from a single file called user-mapping.xml. In this file,you need to define the users allowed to access Guacamole web UI the servers to connect to and the method of connection.
Therefore, run the command below to create this file with the following contents.
Be sure to replace password with your strong password.
Generate the MD5 hash of passwords for the user used for logging into Guacamole web user interface. Replace you password accordingly;
If you need to explicitly define usernames and passwords, add the parameters;
Save and exit the configuration file.
You can check how to enable Guacamole OpenLDAP Authentication;
Setup Apache Guacamole OpenLDAP Authentication
Restart both Tomcat and guacd to effect the changes.
Be sure to check the syslog, /var/log/syslog or /var/log/tomcat9/CATALINA-* for any issues.

Accessing Apache Guacamole from Browse

Once Guacamole is setup, you can access it from web browser using the address http://server-IP:8080/guacamole.
How to Install Apache Guacamole on Ubuntu 24.04 1
Install Apache Guacamole on Ubuntu 24.04
Upon successful login, you get to Apache Guacamole web dashboard and you should be able to see the added connections.
Click on a connection to name to initiate remote login. For example, SSHing into my CentOS-serve gets a me password prompt since we already defined the user;
Install Apache Guacamole on Ubuntu 24.04
To login to Windows 7 via RDP, just click on Windows 7;
Install Apache Guacamole on Ubuntu 24.04
And there you go. Enter your password and proceed to your desktop.
Install Apache Guacamole on Ubuntu 24.04
If windows login fail with the error;
Guacamole: How to fix RDP server closed/refused connection: Security negotiation failed (wrong security type?)
Guacamole Windows RDP Connection Issue
The follow the guide below to fix it;
Guacamole: How to fix RDP server closed/refused connection: Security negotiation failed (wrong security type?)
You can now add more connections to your Guacamole. That marks the end of our guide on install Apache Guacamole on Ubuntu.
Read more on Guacamole.
]]> <![CDATA[Install Edge browser via Powershell | Some Notes on the Machines]]> https://notes.51sec.org/Collections/1aafc8e8-dcfd-819b-a803-f3b57526c2e2 https://notes.51sec.org/Collections/1aafc8e8-dcfd-819b-a803-f3b57526c2e2 Sat, 13 Jun 2026 00:00:00 GMT
This works well as of this writing.
This is a change to a replacement URL, and it will hopefully be a more lasting kind than the previous. The above works for AMD64 Windows; the URL comes from here:
techcommunity.microsoft.com/t5/discussions/official-download-links-for-microsoft-edge-stable-enterprise/m-p/1082549
and there is support for other platforms on that page.
]]> <![CDATA[How Much Does SOC 2 Certification Cost? [2024 Prices]]]> https://notes.51sec.org/Collections/197fc8e8-dcfd-8123-b0ce-cb93dc5b2e0b https://notes.51sec.org/Collections/197fc8e8-dcfd-8123-b0ce-cb93dc5b2e0b Sat, 13 Jun 2026 00:00:00 GMT
notion image

In a Nutshell

There isn’t a single, correct response to the question “How much does SOC 2 certification cost” and there is no sustainable SOC 2 cost. Generally, SOC 2 preparation and certification is a complex process that takes a lot of time and requires financial resources. The entire cost of an audit, including any additional expenditures, can be in the tens to hundreds of thousands of dollars range and is influenced by a variety of factors. You must take into account each one when making decisions, no matter if some of them are under your control or not.
It should be highlighted that the entire cost of SOC 2 certification for SMBs might vary:
  • For SMBs <50 employees: ~$91000, the estimated duration ~ 7 months;
  • For SMBs 50-250 employees: ~$186000, the estimated duration ~ 10 months.
For your convenience, below you can find two tables with approximate estimations of SOC 2 compliance costs for different stages of preparation and for different company sizes.

SOC 2 Type I and Type II Certification Cost Comparison 🠕

Depending on the SOC 2 type you select, you will face various stages, expenses, and time frames. We will cover this topic in terms of SOC 2 Type I because it is more money and time-consuming and most of the work is done here since setting up all the procedures and putting all the tools into use requires a lot of work. SOC 2 Type II preparation takes 6-12 months to collect all evidence and demonstrate that the company has been compliant with requirements over this period of time.
Let’s examine in more detail each of the certification’s requirements, as well as any time and money requirements.

SOC 2 Type I Cost

SOC 2 Type I preparation and audit may take:
Time: 3-6 months – up to 1 year
Total cost: approximately ~$91000-$186000
SOC 2 Type I evaluates a company’s controls and attests to an organization’s use of compliant systems and processes at a specific point in time. SOC 2 Type I indicates a snapshot in time, demonstrating that an organization is compliant at that moment. It describes the controls in use by an organization and confirms that the controls are appropriately designed and enforced and fulfill the required Trust Services Criteria.
SOC 2 Type I is mostly about documents and priority measures that need to be taken. If everything is OK and you have corrected the deficiencies identified during SOC 2 Type I, then you can apply for SOC 2 Type II.
After it is initially released, a SOC report normally remains valid for 12 months. You must conduct an annual audit to maintain SOC 2 compliance.

SOC 2 Type II Cost

SOC 2 Type II preparation and audit may take:Time: 6-15 monthsTotal cost: approximately ~$32000
SOC 2 Type II requires less preparation and SOC 2 Type II cost is less expensive overall than SOC 2 Type I. SOC 2 Type II is about compliance with all written policies. For example, if you have a well-documented HR policy, and when an auditor comes to check, and you actually do not comply with everything or some things are still being improved, non-conformities will be written and compliance will be reviewed next year.
SOC 2 Type II basically includes everything that is part of a Type I report, along with the attestation that the controls are operationally effective and function as intended over some period of time (generally 6-12 months). SOC 2 Type II represents a cumulative perspective of compliance over time. Therefore, even though it’s a far better indicator of compliance maturity, the audit itself is also more expensive.
As you can see, SOC 2 Type I requires much more time to prepare for and conduct certification, and also requires significantly more financial resources.
In the following section, we`ll look into what affects the ultimate cost of certification preparation (including SOC 2 Type I and SOC 2 Type II certification )and passing to clarify why it’s all so expensive and what factors should be considered.
Fast-Track Your SOC 2 Compliance with Free Templates
UnderDefense MAXI: Access 25+ ready-to-use policy templates to jumpstart your certification
Download Templates Now

SOC 2 Certification Cost Breakdown 🠕

The total SOC 2 certification cost, including the audit and additional expenses, can range from tens to hundreds of thousands of dollars and depends on several variables. Whether or not some of them are within your control, you must consider each one when forming an opinion.
If the business is well-prepared, we can quickly determine this right away, thus reducing the cost. The numbers below represent, in a sense, the “worst-case scenario” and the most expensive options. But if everything works like an orchestra, preparing for the audit in about one month is entirely feasible.
The preparation steps are divided differently by different vendors, however, based on our expertise and experience in getting the business ready for the audit, we can state that there are 3 primary aspects to consider that influence the cost of the audit:
  1. Pre-Assessment
      • Pre-Assessment Supervision
      • Software Licenses
      • Penetration Test
      • Awareness Training
  1. External Audit
  1. Fixing Gaps Until SOC 2 Type II Audit
We will focus only on the first two (Pre-Assessment and External audit) steps because they create the base for the third step.

Stage 1. Pre-Assessment

Time: 3-7 months
Cost: 50% FTE or 3d party vendor – $36000-$62000
Performed by: CISO, internal project owner, 3rd party vendors
You can prepare for the audit independently and assign a member of your staff as the Project Owner. But, keep in mind that due to the complexity of the tasks and the preparation process that requires understanding of all business procedures, a C-level management representative will need to be involved. In other words, without the engagement of C-level management as well as your organization’s internal experts even the hired consultant will not be able to handle this task. You must also consider the employee’s remuneration as well as any prospective losses in company revenue brought on by the employee’s departure from the main working process.
It is generally preferable to employ an external consultant whose responsibilities will involve pre-assessment and implementation and who will take up to 80% of the overall load off of this person if you are unsure that you can afford it (for a variety of reasons such as lack of knowledge, time, or other resources).
Pre-Assessment involves the following stages:
  1. Pre-Assessment Supervision
  1. Software Licenses
  1. Penetration Test
  1. Awareness Training

1.1. Pre-Assessment Supervision

At this stage, the person in charge must communicate with the business owner and decide on the applicable Trust Service Criteria that depend on the type of business.
  • Run initial gap analysis to understand what needs to be improved or fixed
  • Run interviews with people in charge and collect information about what is available and what is missing
  • Collect all available documentation and other tangible evidence
  • Based on the previously collected information, prepare and deliver a pre-assessment report with included high-level gap mitigation roadmap
  • Supervise Gap-mitigation process
  • Preparing the documentation that was missing (writing SOC 2 Policies, SOPs, risk assessments, BC/DR plans, etc)
  • Establishing procedures described in SOPs (Special Operation Procedures) and generating, collecting, and storing tangible evidence of it
  • Supervise fixing technical gaps (endpoints, networks, clouds, etc.)

SOC 2 Policies

It’s important to note that SOC 2 compliance requires more than just having policies in place. Organizations must also implement and enforce Policies and Procedures that document the way the organization defines and meets its goals around cybersecurity management. Policies outline how you protect customer data, while procedures explain how you do it. Documenting policies and undergoing formal reviews, with employee participation and acceptance, is crucial for maintaining consistent security measures and proper handling of customer data. This documentation process may be time-consuming but serves as a valuable training tool and can help protect organizations from legal action or employee fraud.
You may want to consider working with a qualified auditor to ensure that your policies and procedures meet SOC 2 requirements.
It is best and most cost-effective to engage with a company that specializes in this to accurately articulate the policy as opposed to hiring a CISO, which would be significantly more expensive.
Not all compliance platforms offer security policy templates and sometimes they are incorporated into the price of audit preparation assistance. However, at UnderDefense we decided to create open-source SOC 2 policy templates that include best practices and make them free of charge. They can be used as models or as a starting point for modifications to fit the needs of your business. Additionally, we can offer you the assistance of our experts to walk you through this process. We hope it will reduce the stress of SOC 2 and point your business in the right direction.
SOC 2 Policies Preparation May take:
Time: 1,5-2 months
Cost: approximately $4000-$7000
Performed by: CISO, internal project owner, 3rd party vendors
We can take the burden off your shoulders and offer you free access to SOC 2 policy templates which can save you up to $7000 Basically if you have all the necessary data, you can tune the policies so that they match your company’s needs. Of course, there are a ton of policy templates online, but you never know if the auditor will accept them. We can guarantee that our policies are reliable because they have already been through SOC 2 examinations.
Cut SOC 2 Certification Costs by $7000
UnderDefense MAXI: AI-powered platform with expert-crafted templates for efficient compliance
Get Your Free Template Kit

1.2. Software Licenses and Installation

Software Purchase and Installation may take:
Time: 2-3 months
Cost: ~$12000-$60000
Performed by: CISO, internal project owner, 3rd party vendors
The scoped service is frequently delivered with the assistance of multiple applications or business functions which would raise your anticipated cost. This can include security incident and event management (SIEM) tools, vulnerability scanners, password managers, anti-virus software, network security devices, and other native services provided by your cloud service providers. To manage the environment’s security, for instance, the price might comprise backend software, a database, infrastructure, and multiple IT teams. It might also include management staff who process, judge, and report information. However, if you’d like to delegate the tasks and responsibilities mentioned above, you can apply for our Managed Detection and Response Service or Network Security Assessment.
The complexity increases if all of this is done differently due to various regulatory restrictions in each place. The price of the licensed software is a separate cost item, but if installation is required, it is also covered by the cost of services.
Our explanation is much simplified, and it is important to note that the software mentioned is just one integral part of a larger cybersecurity system. The implementation of a comprehensive cybersecurity system is crucial for protecting sensitive information and digital assets from unauthorized access, theft, damage, or disruption.
If you would like to find out more, you can refer to a great chart from NATO that provides a helpful overview of various cybersecurity systems. You can use it as a resource to gain a better understanding of the various components that make up a comprehensive cybersecurity system.

1.3. Penetration Test

Complex Penetration Test may take:
Time: 1-4 weeks
Cost: $8000-$25000
Performed by: 3rd party vendors
You’ll also need to budget for penetration testing that can assist in identifying potential vulnerabilities in your defenses as you get ready for your SOC 2 audit. You will be able to evaluate the vulnerabilities in your apps, network infrastructure, and physical security barriers through various tasks carried out by security professionals. There will be expenses involved with the penetration test for your firm, regardless of whether these professionals are internal or contracted from a third-party company.

1.4. Awareness Training

Security Awareness Training may take:
Time: 3-5 days
Cost: $6000-$9000
Performed by: 3rd party vendors
It is a necessary added expense to be taken into account. You should start offering annual security awareness training, either internally or through a third party; in either case, there will probably be a cost. Someone will need to ensure that everyone in the organization attends the training and approves of getting it.

Stage 2. External Audit

External Audit may take:
Time: 3 months
Cost: $20000-$30000
The auditor arrives and performs the audit at the predetermined time. You might get preparation advice from the auditor as well. The cost may vary when selecting between different CPA firms as your auditor and the price will be determined by the brand reputation and popularity rather than its size. The benefit of working with stronger players is the awareness of their brand, but beware—this glamor will cost you. A less popular business will have just as capable auditors and might be far more reasonably priced.

Stage 3. Fixing Gaps Until SOC 2 Type II Audit

This stage involves the remediation of nonconformities found or detected during the SOC 2 Type I audit.
The certification needs to be renewed annually. To obtain SOC 2 Type II you need to confirm that you have corrected all the deficiencies found during SOC 2 Type I marked as nonconformities by providing the auditor with evidence.

Additional Factors That Affect SOC 2 Certification Cost 🠕

The overall cost of SOC 2 certification may as well be impacted by the following elements:

Productivity Сosts

To focus on SOC 2 preparation, you might need a software engineer, a data scientist, a legal specialist, and a technical writer. Your team will inevitably have less time to work on other initiatives as it focuses on obtaining compliance. This might lead to a reduction in overall productivity.
It is crucial for the company to determine whether to hire more staff. It is quite expensive because, in the worst-case scenario, remediating from Type I to Type II can take up to a year, consequently, the approximate cost will be equal to the annual salary of a specialist. Also, several specialists may be required, depending on the size of the company. As an alternative, involving a third party helps to reduce costs significantly.

Internal Blockers

Most organizations simply take into account the primary audit-affecting factors, but in light of our experience, we want to draw attention to a few issues that can substantially slow down the audit preparation and passing process:
  • Time management – failure to fulfill assignments on time, delaying completion of projects for an extended length of time
  • Communication management – difficulties finding a person who can communicate problems within the organization; vCISOs are forced to spend 80% of their time on communication within the company and only 20-30% on the implementation of some tasks. Your audit will be more affordable if you can make your methods more consistent.
  • No person committed to the process – nobody working for the organization is prepared to oversee the entire process and, if required, use their power to accelerate it (whether it is software installation or any other task)

Legal Fees

Reviewing contracts with clients, suppliers, contractors, and workers will cost you some money in legal fees. These agreements’ data protection rules may affect how audit-ready they are.
Review all customer agreements, vendor and contractor agreements, and employee agreements with your lawyer. These agreements will lay the groundwork for duty delegation, enabling you to express your confidentiality, privacy, and security policies. With every audit, you might need to review these. Consider that this will be a recurring SOC 2 expense.
Achieve SOC 2 Compliance in Weeks, Not Months
UnderDefense MAXI: Expert-crafted templates and vCISO support for efficient certification
Get Started Now

Approximate SOC 2 Type I Compliance Cost for SMBs 🠕

We are going to provide a description and approximate calculations to clarify the situation and give you a rough understanding of what to expect when you decide to achieve SOC 2 certification. Based on our experience, we will present all calculations using the SMB as an example.

SOC 2 Certification Cost for SMBs with Up to 50 Employees

The approximate SOC 2 compliance cost breakdown for SMBs with up to 50 employees might be around $91,000, as detailed in the table below.
  • the duration and expenses can vary

SOC 2 Certification Cost for SMBs with 50-250 Employees

The approximate SOC 2 certification cost breakdown for SMBs with 50-250 employees might be around $186,000, as detailed in the table below.
  • the duration and expenses can vary

SOC 2 Type I Audit Preparation Timeline 🠕

The total time to complete SOC 2 Certification could vary between 6-10 months depending on the size of your organization. Take a look at the timelines to estimate the approximate time needed to finish the project.

SOC 2 Certification Timeline for SMBs with Up to 50 Employees

In the best situation, when the Project Owner and your team work in a synchronized and accurate way, SOC 2 Audit for SMBs with around 50 employees could be finished in 3-6 months.

SOC 2 Certification Timeline for SMBs with 50-250 Employees

In the best situation, when Project Owner and your team work in a synchronized and accurate way, SOC 2 Audit for SMB with around 50-250 employees could be finished in 9-10 months. Most of the time will be spent on Gap Analysis Stage to define the missing points because of the size of an organization.

Does It Make Sense to Prepare for SOC 2 Audit on My Own? 🠕

Independent Preparation for Certification:

If you are confident in your abilities, you can attempt to prepare on your own; consulting services are not necessary in order to obtain certification. Yet it can have a substantial impact on the amount of time needed for preparation and the likelihood of passing the certification at the first attempt. You can prepare on your own, but we must remind you about the potential hazards and challenges involved.

Preparation for Certification With an InfoSec Consultant:

Seek outside advice and engage qualified experts, such as the vCISO, who have been around the block so many times and will scrutinize all the details.
Join 500+ Companies Simplifying SOC 2 Compliance
UnderDefense MAXI: Save time with customizable, expert-verified policy templates
Get Started in Minutes

Simplify Your SOC 2 Journey: Get Certified Without the Hassle 🠕

Stop drowning in paperwork and stressing over deadlines. UnderDefense provides cost-effective cybersecurity compliance services making SOC 2 certification effortless and affordable. Ditch the manual work and embrace automation with our easy-to-use platform.
Here’s how we’ll transform your SOC 2 experience:
  • Continuous monitoring: Never scramble again. Our system constantly validates your compliance, automatically catching and alerting you to issues before they become problems.
  • All-in-one tools: No need for expensive software subscriptions. MDM, Security Awareness Training, and Incident Tracking are seamlessly integrated within the platform.
  • Expert network: Access discounted penetration tests and vulnerability assessments through our trusted partners. We even support free/open-source vulnerability scanners for added savings.
  • Affordable audits: Price varies based on your organization’s size but is significantly lower than traditional solutions.
  • Real-time readiness: Track your progress towards certification anytime, anywhere, with our intuitive dashboard.
  • Expert support: Our dedicated compliance specialists guide you through every step, ensuring a smooth and stress-free process.
  • Boost productivity: Stop wasting valuable employee time on manual tasks. Focus on what truly matters while UnderDefense handles the compliance burden.
  • Security measures: We cover all bases to meet SOC 2 security monitoring requirements, from conducting penetration tests to providing SOC services.
  • Fast track to certification: Get audit-ready in weeks, not months.
The results? Hundreds of hours saved, issues caught proactively, and a hassle-free SOC 2 report.
Ready to simplify your SOC 2 journey?
Get advice on passing the certification by contacting our sales department. We’d be happy to assist you anytime and share your joy after achieving SOC 2 Certification!

Frequently Asked Questions

How long is a SOC 2 report valid?

A SOC 2 report is typically considered valid for one year from the date it’s issued. While it doesn’t officially expire, it’s generally considered outdated and less valuable to potential clients after that timeframe. Most organizations renew their reports annually to maintain trust and demonstrate ongoing compliance.

Does SOC 2 require penetration testing?

Penetration testing is not mandatory for SOC 2 compliance. However, it can be a valuable tool to identify and address vulnerabilities in your system, potentially making your audit smoother. Depending on your specific controls and risk profile, SOC 2 Type 2 may recommend or even require penetration testing.

How much does an SOC 2 audit cost for a small company?

Costs can vary depending on several factors, like the size and complexity of your organization, the type of SOC 2 report (Type 1 or 2), and the chosen auditor. However, for a small company, expect costs to range from $5,000 to $20,000. UnderDefense offers solutions specifically designed for small businesses to make the process more affordable.

Who needs SOC 2 certification?

SOC 2 certification isn’t mandatory for any organization. However, it’s increasingly demanded by businesses, especially those dealing with sensitive data or working in highly regulated industries. It can demonstrate your commitment to security and compliance, improving trust with clients, partners, and investors.

How long does a SOC 2 audit take?

The timeframe for a SOC 2 audit varies based on the scope and complexity of your organization. Generally, expect a Type 1 audit to take 1-3 months, while a more in-depth Type 2 audit can take 3-6 months. You can significantly streamline the process by preparing beforehand and choosing an efficient service like UnderDefense.
]]>