This post has moved — continue to /blog/security-testing-planning/