A security device includes a physical unclonable function (PUF) cell array including a plurality of PUF cells, and a controller configured to control the PUF cell array to generate a security key. The controller includes a receiver configured to receive raw data from the plurality of PUF cells, a mapping table generator configured to extract stable data from the received raw data by discarding unstable data of the received raw data, and generate a mapping table based on stable PUF cells corresponding to the extracted stable data, among the plurality of PUF cells, a PUF cell controller configured to read sensing data from the stable PUF cells, based on the generated mapping table, and a bit determiner configured to generate the security key, based on the read sensing data.