"A security policy based on exceptions is a weak one." could be removed. It seems a bit detached and more of an opinion than anything (even if it is a good one).