System and method of defining the security condition of a computer system

A method of defining vulnerability conditions of a system coupled to a global network, comprising:

• specifying a name of an attack associated with a vulnerability of the system;
• specifying at least one attribute of the specified attack, and the severity of the specified attack associated with a breach of the computer system by the specified attack;
• specifying a policy definition with respect to the specified attack;
• specifying at least one attribute of the specified policy definition;
• specifying a computing platform of the system.

A system of defining security conditions of a computer system, comprising:

• a vulnerability description file containing a definition of at least one attack and a definition of at least one policy item for the attack;
• an interpreter operable to parse the at least one attack and at least one policy item definition in the vulnerability description file and organize the parsed definitions pursuant to a predetermined format;
• and
• a data storage operable to store the parsed and organized at least one attack and at least one policy item definition, wherein the data storage is accessible by at least one security application.