A Framework For Deriving Verification And Validation Strategies To Assess Software Security