Yes it is, and has been done. Subject to [edit: a] security policy (NOT defined by implementation) and a meaningful statement of threat (what are you protecting against?)

This paper might prove to be an enlightening read: http://www.mdpi.com/2078-2489/7/2/23