A method for providing security for a programmable logic controller, comprising: coupling a security module between the PLC and a remote network, and between the PLC and a control network; cloning the security module as a PLC proxy for a PLC module, the cloning comprising copying at least one of a media access control address and an internet protocol address of the PLC to the security module; receiving at the security module data that are addressed to the PLC and are coming from the remote network and/or from the control network, the data comprising at least one of the media access control address and the internet protocol address of the PLC; whereas the security module is configured to be transparent to users of the control network and to users of the remote network and appears to users that have direct access to the control network from the remote network, the method being characterized by further comprising: monitoring by the security module data traffic on the control network for certain addresses, users, or data content in the data and if the security module detects an abnormality during its monitoring of traffic on the control network, sending by the security module a warning or alert message to the remote network, and monitoring by the security module incoming data traffic from the remote network and if the security module detects an abnormality, blocking by the security module the incoming traffic. coupling a security module between the PLC and a remote network, and between the PLC and a control network; cloning the security module as a PLC proxy for a PLC module, the cloning comprising copying at least one of a media access control address and an internet protocol address of the PLC to the security module; receiving at the security module data that are addressed to the PLC and are coming from the remote network and/or from the control network, the data comprising at least one of the media access control address and the internet protocol address of the PLC; whereas the security module is configured to be transparent to users of the control network and to users of the remote network and appears to users that have direct access to the control network from the remote network, the method being characterized by further comprising: monitoring by the security module data traffic on the control network for certain addresses, users, or data content in the data and if the security module detects an abnormality during its monitoring of traffic on the control network, sending by the security module a warning or alert message to the remote network, and monitoring by the security module incoming data traffic from the remote network and if the security module detects an abnormality, blocking by the security module the incoming traffic. monitoring by the security module data traffic on the control network for certain addresses, users, or data content in the data and if the security module detects an abnormality during its monitoring of traffic on the control network, sending by the security module a warning or alert message to the remote network, and monitoring by the security module incoming data traffic from the remote network and if the security module detects an abnormality, blocking by the security module the incoming traffic.