A Framework for Characterizing the Security Posture of Cyber Systems