A network bridge device for applying communications security services to messages passing by means of the device between a first network and a second network, the device comprising: a first network interface for linking to the first network and a second network interface for linking to the second network; a first hardware logic module arranged to receive a message from the first network interface and configured to apply, to the message received from the first network interface, a first set of one or more predetermined message content security functions and to output or to block the message received from the first network interface according to the result of applying said first set of one or more functions; a second hardware logic module configured to apply, to the message received from the first network interface, device authentication data according to a predetermined authentication scheme to enable the device to be identified as a trusted source of the message; a third hardware logic module configured to apply, to a message received from the second network interface, the predetermined authentication scheme to identify a source of the message received from the second network interface as a trusted source; and a fourth hardware logic module configured to apply, to the message received from the second network interface, a second set of one or more predetermined message content security functions and to output or to block the message received from the second network interface according to the result of applying said second set of one or more functions, wherein the first network interface is linked to the second network interface by a unidirectional data pathway incorporating the first hardware logic module and the second hardware logic module to ensure unidirectional flow of messages from the first network interface to the second network interface by means of the first and second hardware logic modules (355, 360) only and wherein the second network interface is linked to the first network interface by a unidirectional data pathway incorporating the third hardware logic module and the fourth hardware logic module to ensure unidirectional flow of messages from the second network interface to the first network interface by means of the third and fourth hardware logic modules (415, 420) only. a first network interface for linking to the first network and a second network interface for linking to the second network; a first hardware logic module arranged to receive a message from the first network interface and configured to apply, to the message received from the first network interface, a first set of one or more predetermined message content security functions and to output or to block the message received from the first network interface according to the result of applying said first set of one or more functions; a second hardware logic module configured to apply, to the message received from the first network interface, device authentication data according to a predetermined authentication scheme to enable the device to be identified as a trusted source of the message; a third hardware logic module configured to apply, to a message received from the second network interface, the predetermined authentication scheme to identify a source of the message received from the second network interface as a trusted source; and a fourth hardware logic module configured to apply, to the message received from the second network interface, a second set of one or more predetermined message content security functions and to output or to block the message received from the second network interface according to the result of applying said second set of one or more functions, wherein the first network interface is linked to the second network interface by a unidirectional data pathway incorporating the first hardware logic module and the second hardware logic module to ensure unidirectional flow of messages from the first network interface to the second network interface by means of the first and second hardware logic modules (355, 360) only and wherein the second network interface is linked to the first network interface by a unidirectional data pathway incorporating the third hardware logic module and the fourth hardware logic module to ensure unidirectional flow of messages from the second network interface to the first network interface by means of the third and fourth hardware logic modules (415, 420) only.