A control network comprising: a controller; and a controlled device, wherein said controlled device has a first level of operation, the first level of operation comprising a device discovery function, whereby the controlled device is configured to respond to device discovery messages received from said controller with a discovery response message, wherein said discovery response message comprises a first data field indicating a current security mode; wherein said controlled device has a second level of operation, and wherein said controlled device is configurable to operate in one of a plurality of security modes; said plurality of security modes comprising: a first security mode wherein said second level of operation is always enabled; a second security mode wherein said second level of operation is disabled until said controller and said controlled device perform an encryption key exchange using a predetermined encryption key; and a third security mode wherein said second level of operation is disabled until said controller initiates encrypted communication using a manually entered encryption key; wherein, in said second security mode and said third security mode, said controlled device is configured to drop unencrypted application level messages received from said controller; and wherein said controlled device comprises a viewable surface comprising a text string from which said manually entered encryption key is obtained. a controller; and a controlled device, wherein said controlled device has a first level of operation, the first level of operation comprising a device discovery function, whereby the controlled device is configured to respond to device discovery messages received from said controller with a discovery response message, wherein said discovery response message comprises a first data field indicating a current security mode; wherein said controlled device has a second level of operation, and wherein said controlled device is configurable to operate in one of a plurality of security modes; said plurality of security modes comprising: a first security mode wherein said second level of operation is always enabled; a second security mode wherein said second level of operation is disabled until said controller and said controlled device perform an encryption key exchange using a predetermined encryption key; and a third security mode wherein said second level of operation is disabled until said controller initiates encrypted communication using a manually entered encryption key; a first security mode wherein said second level of operation is always enabled; a second security mode wherein said second level of operation is disabled until said controller and said controlled device perform an encryption key exchange using a predetermined encryption key; and a third security mode wherein said second level of operation is disabled until said controller initiates encrypted communication using a manually entered encryption key; wherein, in said second security mode and said third security mode, said controlled device is configured to drop unencrypted application level messages received from said controller; and wherein said controlled device comprises a viewable surface comprising a text string from which said manually entered encryption key is obtained.