System security assessment tool