A completely secure system is a system that has zero contact with its attackers. Life gets complicated when there is contact with the attackers, or the attackers are unknown.
I gave this topic a pretty good treatment a while ago on the post titled, How do you search for backdoors from the previous IT person? which is the 'worst case scenario' you're talking about. A trusted insider demonstrates they're not worthy of the trust placed on them (i.e. a SysAdmin leaves on bad terms and just might be ethically challenged). That big bulleted list shows all the areas that network defenses have to take in to account.
Is there perfect security? Yes, it's that completely isolated system I opened up with. But you can't create a Facebook with a completely isolated system. Is it possible to have perfect security and still have a connected system? In theory, yes. In practice, no way.
In order to get to a perfectly secured, connected system, you must have:
- All possible inputs mapped.
- Processing logic is verified to handle all possible inputs, including error cases, safely.
- Every logic path is verified to run cleanly without unhandled fault.
- Unhandled exceptions, some unmapped inputs may need to be introduced to cause them, are verified to fail safely.
This is not going to happen anywhere but in the laboratory of the mind, or some tinker's "build an entire computer from scratch" test-case.
You can get pretty close to perfect, but the cost of being there is pretty high. The closest we get is probably avionics software, which has a pretty limited and exceedingly well known input base.
For modern computer and network security, the problem is very complex and very diverse. Precise strategies vary from organization to organization, though there are some commonalities in approach. The dictates of the organization will define whether or not file-level change-tracking is required on systems, or if the patch-log is sufficient; things like that.
If you have an interest in this domain, I recommend our sister site, https://security.stackexchange.com/ which is dedicated to IT security as a whole.