A Security Group can be empty because it is a logical entity used to group together various security appliances for management and policy application. The minimal requirement is that there is no necessity for having any appliances or management ports assigned to it.