The need for a penetration testing framework