how to perform security testing