What Testers Need to Know about Security