Method for objectively and completely indentifying system residual vulnerabilities

A non-transitory machine-readable medium including instructions for implementing an object based vulnerability model comprising the steps of:

• identifying each component in the information system and annotating such component in a database;
• decomposing each component into major functional objects and annotating each object in a database;
• identifying actions an attacker could take to modify the behavior of the functional objects comprising an information system and annotating such action in a database;
• capturing a trust score and a trustworthiness score for each object and annotating the trust score and the trustworthiness score in the database;
• assessing each action on structure, state, and inputs of each functional object to determine if an interaction exists and annotating the interaction existence in the database;
• applying preventive countermeasures to those interactions posing a risk;
• and
• applying reactive countermeasures to those interactions posing a risk not protected by preventive countermeasures.