A method of executing either an unsigned operating system or a signed operating system on a device having a processor and a collection of hardware resources designated as a security block, the security block comprising user data and device specific cryptographic keys, the device being operable in a factory mode where access to the security block is not allowed and in a product mode where access to the security block is allowed, said method comprising the processor loading a boot loader and under instructions from the boot loader: loading an operating system and subsequent to loading the operating system; determining whether said device is in the factory mode or in the product mode; on determining that the device is in factory mode: determining whether the operating system is signed by a trusted entity: if the operating system is signed by a trusted entity allowing execution of the operating system on authentication of operating system and denying execution of operating system on failure to authenticate the operating system; if the operating system has not been signed by a trusted entity and represents an untrusted operating system, determining whether a counter of allowed insecure boots exceeds zero and: upon determining that the counter of allowed insecure boots exceeds zero, decrementing the counter of allowed insecure boots and disabling access to the security block to maintain security for user data and cryptographic keys saved in or protected by the security block, the disabling further comprising erasing all user data not stored in or protected by the security block and, once access to the security block has been disabled, allowing execution of the untrusted operating system; or upon determining (step 312) that the counter of allowed insecure boots has reached zero, deactivating factory mode and restarting the device to exit factory mode; on determining that said device is in product mode determining whether the operating system is authenticated and allowing execution of the operating system on authentication of operating system and denying execution of operating system on failure to authenticate the operating system. determining whether said device is in the factory mode or in the product mode; on determining that the device is in factory mode: determining whether the operating system is signed by a trusted entity: if the operating system is signed by a trusted entity allowing execution of the operating system on authentication of operating system and denying execution of operating system on failure to authenticate the operating system; if the operating system has not been signed by a trusted entity and represents an untrusted operating system, determining whether a counter of allowed insecure boots exceeds zero and: upon determining that the counter of allowed insecure boots exceeds zero, decrementing the counter of allowed insecure boots and disabling access to the security block to maintain security for user data and cryptographic keys saved in or protected by the security block, the disabling further comprising erasing all user data not stored in or protected by the security block and, once access to the security block has been disabled, allowing execution of the untrusted operating system; or upon determining (step 312) that the counter of allowed insecure boots has reached zero, deactivating factory mode and restarting the device to exit factory mode; if the operating system is signed by a trusted entity allowing execution of the operating system on authentication of operating system and denying execution of operating system on failure to authenticate the operating system; if the operating system has not been signed by a trusted entity and represents an untrusted operating system, determining whether a counter of allowed insecure boots exceeds zero and: upon determining that the counter of allowed insecure boots exceeds zero, decrementing the counter of allowed insecure boots and disabling access to the security block to maintain security for user data and cryptographic keys saved in or protected by the security block, the disabling further comprising erasing all user data not stored in or protected by the security block and, once access to the security block has been disabled, allowing execution of the untrusted operating system; or upon determining (step 312) that the counter of allowed insecure boots has reached zero, deactivating factory mode and restarting the device to exit factory mode; upon determining that the counter of allowed insecure boots exceeds zero, decrementing the counter of allowed insecure boots and disabling access to the security block to maintain security for user data and cryptographic keys saved in or protected by the security block, the disabling further comprising erasing all user data not stored in or protected by the security block and, once access to the security block has been disabled, allowing execution of the untrusted operating system; or upon determining (step 312) that the counter of allowed insecure boots has reached zero, deactivating factory mode and restarting the device to exit factory mode; on determining that said device is in product mode determining whether the operating system is authenticated and allowing execution of the operating system on authentication of operating system and denying execution of operating system on failure to authenticate the operating system.