NIST, Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115) (Sept. 2008) (full-text)