Abstract: Described systems and methods allow protecting a host system against computer security threats, and in particular against ransomware and unauthorized access to private data. In some embodiments, a conventional non-volatile storage unit (e.g., magnetic, optical, or solid state drive) is paired with a dedicated security processor, forming a secure storage device which may connect to the primary processor of the host system via a conventional storage interface, such as a SATA, PCI, or USB connector. The primary processor and the security processor exchange messages and data via the storage interface. The security processor controls access of the primary processor to the storage unit, and may execute security and data encryption operations.