the final System Operation phase, Zulkernine and Ahamed not only exclude
testing, verification, or validation from their waterfall model but from their list
of security engineering activities. This omission is interesting because security
reviews, tests, verifications, and validations (starting early in the software life