This is way too high level a statement, only good for satisfying an auditor. For actual security, it's much harder.