We may be able to say that X Y and Z are necessary since I can show you a concrete attack if you omit one. But we can never be absolutely certain that they're sufficient. Still, we've had something like 30-40 years of research by now looking at how to specify security properties. We certainly didn't get many things right the first time around. For the "basic" stuff, like confidentiality and authenticity we likely have a reasonably good grip on it under some, let's say "reasonable" assumptions. But a lot of research also still goes into developing notions of security with weaker assumptions or more exotic goals.