process of defining, identifying and classifying the security holes in information technology systems