Some sources, e.g. ISTQB, claim that security testig is a functional one. This would be compliant with ISO 9126 (which the ISTQB is based on) but it goes against most other sources - as far as I know, security is a non functional requirement. In ISO 25010, security is one of the quality characteristics (non functional).
I believe security testing is non functional testing as we do not test functionality, we examine the system from this perspective the same way we test performance.