Assessing vulnerabilities and evaluating computer system security