A controller is included in a storage device communicating with a host device. The controller is configured to receive a firmware image download command and a firmware image corresponding to the firmware image download command from the host device, perform verification for determining whether the firmware image is damaged in response to the received firmware image download command, and when a firmware update request for the firmware image is received from the host device, determine whether to perform a firmware update based on the firmware image by using a verification result of the firmware image.