The Art of Software Security Assessment