Mayeenul Islam - thats no lame point you make regarding Open Source. If we consider that Microsoft - one of the world's largest software and system's developers and producers is also one of the worlds most invaded systems - having 'closed down code' is in no way more secure than having a code base watched over by hundreds if not thousands of developers and users.
To my recall, the biggest failings in security tend not to be down to software but implementation. Wordpress out of the box is as secure as it can be - but people still choose stupidly easy to guess password - or none at all, or run services without HTTPS etc. All of which you can do on a home grown system and be just as insecure.
Having as secure as system as possible starts way ahead of software and platform choice, it starts with implementation, policy, making sure that you know what you are after. Then choose a platform that has consistently plugged its leaks and holes and above all - is open about informing its client and development community about these issues. If we know there is an issue - we can plan and patch accordingly, if the reverse is true - we end up having to wipe-clean and rebuild.
I recall holes in Windows that were discovered to go way back to 3.1 and were known about and left because they were regarded as 'obscured'.
Open Source solutions are not perfect, but by their very definition it is far easier to find, spot, report and correct flaws.
The original question - how do you prove that a system is secure - you cannot - no system ever has been or ever will be secure. The moment such a claim is made every hacker in the world has a case to prove in taking it down. It is far more sensible and honest to understand that we make things as secure as we can, and develop operations and means of working with systems that promote a sense of secure usage.