Abstract: A secure communications network having different types of subscriber terminals (1-4) and switching modules (7-8) connected to other switching modules in the network includes cryptographic devices (13-15) where at least one of the cryptographic devices is a cryptographic-pool device having a number of cryptographic modules (35) wherein the cryptographic-pool device is physically separated from the switching modules (7,8), and wherein at least one of the cryptographic-pool devices (13-18) is within a security guard (9 or 10) connected between a switching module (7 or 8) and the network. A security guard may include routing devices (32,31) or handling control signals that specify protection criteria. A managing device (30) may also be included within a security guard for deciding the manner for carrying a communication channel through the security guard and for setting out rules for governing security-guard decision-making. The managing device may be selectively controlled both on-line and off-line.