A decoder for descrambling encoded satellite transmissions comprises an internal security element and a replaceable security module. The program signal is scrambled with a key and then the key itself is twice-encrypted and multiplexed with the scrambled program signal. The key is first encrypted with a first secret serial number (SSN.sub.1) which is assigned to a given replaceable security module. The key is then encrypted with a second secret serial number (SSN.sub.0) which is assigned to a given decoder. The decoder performs a first key decryption using the second secret serial number (SSN.sub.0) stored within the decoder. The partially decrypted key is then further decrypted by the replaceable security module using the first secret serial number (SSN.sub.1) stored within the replaceable security module. The decoder then descrambles the program using the twice-decrypted key. The replaceable security module can be replaced, allowing the security system to be upgraded or changed following a system breach.