An integrated circuit is operable to execute boot loader code and a boot code from external memory. To provide security so that the CPU does not execute malicious codes, the circuit resets in a restricted mode in which only certain functional units may be connected. In the restricted mode the CPU is only able to fetch boot code from an external memory for transfer to an internal memory. A hash function operates on the fetched boot code to determine whether it is authentic and, if it is determined that the code is authentic the circuit is reset to an unrestricted mode to continue executing from the boot code now stored in the internal memory. Further security is provided by a watchdog timer function which resets the circuit if the boot code is not determined to be authentic within a threshold period of time.