A Formal Approach for Testing Security Rules