http://www.securityinnovation.com/pdf/testing_so_hard803.pdf