Security Testing and the SDLC