After identifying a misuse story, the next step is to create
an acceptance test that manifests the story using the web
testing tool Selenium (http://www.openqa.org/selenium/).
The rationale for using Selenium for security testing is
to leverage a tool that is already in use by the development
team, avoid learning and maintaining a separate tool for
security. Furthermore, a familiar tool could help to narrow
the gap between ‘a typical’ developer and a security specialist.
Having security requirements written as web tests
also supports and enhances collective ownership.