This is a good 5 page introduction to software security testing that concisely lays out the issues and a ‘how to’ approach. There is also an overview on automating software security testing.

This is an organization, not for profit, that focuses on improving software security for all. This site contains a lot of information and useful links. The getting started page has a great reference to risk models and other prerequisites for anyone interested in getting practical knowledge about this complicated field.