Salesforce gives you the tools to build a robust security model. And therein lies the false sense of security. You have the tools! Using these tools, and adding your own are the real challenge of securing your org.