The Why and Symbology

This is an intro to PG Security Advisors. PGSA is a small AppSec firm that is built to help people build up and build out their software security programs. It's more about the programs, governance, people, culture, process, tooling, integration, expectations, training, and on and on. We aren't a pen test company. It's not that we can't do it, we just focus on larger scale challenges as it's been proven time and again that one simply cannot test themselves secure.

I've always liked to build things with a purpose. All the details have a purpose, they all mean something. I've done this for as long as I can remember. I've spent weeks on a single diagram, tuning, and tweaking, each shape, color, shading, pattern with a specific meaning. I've built the elements around PGSA the same way, here are some examples of what I'm talking about.

You will notice in the name we are "Advisors" and not "Consultants". This is deliberate. For many people, the term consultants have a bad connotation. Consultants like to charge large fees, parachute in, give you a large report of what's wrong and then say "good luck" and head out. Not all consultants do this, but enough of them did to sour the term for many people. I like the term "Advisor" much better. It connotes a long term relationship built on trust. For centuries, people have relied on their trusted advisors, because they understand that they don't have the time to learn everything they need to know in all the different areas.

The logo was designed to project the understanding that our focus is more strategic. It's not about hammering out some security test in a week to check a box. It's about how to fix your process so that you aren't in the situation in the first place. Thinking four, five, ten moves ahead. Working through scenarios to try to determine a better path forward for your organization. The three pieces in the main logo are deliberate choices as well.

The King represents your critical assets. If this piece is taken, you have lost. There is always something that you need to protect, that's why security exists. Unfortunately, not everyone has your best interests at heart. It can be difference for each organization, it might be intellectual property, brand, customer trust, or something else. At the same time, PGSA strives to be pragmatic and realistic, we don't deal in FUD (Fear, Uncertainty, & Doubt) that are too often used to sell security.

The Castle (or Rook) represents your organization. An organization's culture is everything for security. Your culture will dictate what is held in high esteem by your employees. If your culture accepts that security is the security team's responsibility, most of the people outside the security team won't terribly care about security and determine that it's just not their problem. If your culture embraces security as one of many disciplines that are a shared responsibility that people are rewarded for caring about, then you will see real progress on many fronts.

The Knight is your security team and champions. These are the people that are responsible for representing your organization from a security discipline. They work together to learn how to translate the larger world of application or software security into how it should be implemented at your organization. They help spread the knowledge of what to do and how to do it for your organization. 

The colors are shades of grey, as rarely in application security are things simply black and white. One does not eliminate risk, but rather has to make decisions on how best to manage the risk to the business. All decisions have costs and benefits, making good decisions will swing that ratio in your favor.

One of the primary goals and services at PGSA is a Security Advisor Program. This is where you get someone to spend up to a set number of hours a month helping you with your security program. It might be helping build a case for funding, performing a current state analysis using OWASP SAMM, building or reviewing policies/standards/etc, or building process integrations between security and developer or business processes. Work that needs experience that is either too difficult or expensive to hire full-time positions.

If this sounds like something that can help you in the application or software security area, please reach out and we can chat.