Application Security Testing: The Double-sided Black Box(infoq.com)

http://www.infoq.com/articles/rohit-application-security-testing