A security module for a CAN node includes a RXD input interface for receiving data from a CAN bus, TXD output interface for transmitting data to the CAN bus, and a RXD output interface for providing data to a local controller. The security module is configured to receive a CAN frame from the CAN bus. The CAN frame includes a CAN message. The security module is also configured to compare an identifier of the received CAN frame with at least one identifier associated with the local controller; and upon detection of a match between the identifier of the received CAN frame and the at least one identifier associated with the local controller: pass the CAN message to the local controller via the RXD output interface; decouple the local controller from the CAN bus; and invalidate the CAN message on the CAN bus via the TXD output interface.