A security device for protecting a protected device, the security device comprising: read enable input and output terminals; write enable input and output terminals; a plurality of input lines connected to data lines of the protected device; an RE switch intervening between the input and output RE terminals; a WE switch intervening between the input and output WE terminals; and a lock unit connected to the input lines and the switches, the lock unit comprising: a decision logic block for (i) detecting a command signal on the input lines, (ii) detecting and validating a permission code on the data lines, (iii) decoding the command signal and, on successful validation of the permission code, generating a lock/unlock state for closing any of the switches in response to the decoded signal, and (iv) during the decoding and lock/unlock-state generation, opening the switches, wherein any open switch prevents signals on the corresponding input terminal from reaching the corresponding output terminal; a non-volatile memory for storing the lock/unlock state; and circuitry responsive to the non-volatile memory for operating the switches in accordance with the lock/unlock state; wherein the security device further comprises memory accessible by the decision logic block, and wherein either; the memory accessible by the decision logic block is configured to store a one-time pad base wherein the decision logic block is configured to validate the permission code by comparing the permission code to an entry in the one-time pad base, or; the memory accessible by the decision logic block is configured to store a shared secret, wherein the decision logic block is configured to validate the permission code by comparing the permission code to the stored shared secret. read enable input and output terminals; write enable input and output terminals; a plurality of input lines connected to data lines of the protected device; an RE switch intervening between the input and output RE terminals; a WE switch intervening between the input and output WE terminals; and a lock unit connected to the input lines and the switches, the lock unit comprising: a decision logic block for (i) detecting a command signal on the input lines, (ii) detecting and validating a permission code on the data lines, (iii) decoding the command signal and, on successful validation of the permission code, generating a lock/unlock state for closing any of the switches in response to the decoded signal, and (iv) during the decoding and lock/unlock-state generation, opening the switches, wherein any open switch prevents signals on the corresponding input terminal from reaching the corresponding output terminal; a non-volatile memory for storing the lock/unlock state; and circuitry responsive to the non-volatile memory for operating the switches in accordance with the lock/unlock state; wherein the security device further comprises memory accessible by the decision logic block, and wherein either; the memory accessible by the decision logic block is configured to store a one-time pad base wherein the decision logic block is configured to validate the permission code by comparing the permission code to an entry in the one-time pad base, or; the memory accessible by the decision logic block is configured to store a shared secret, wherein the decision logic block is configured to validate the permission code by comparing the permission code to the stored shared secret. a decision logic block for (i) detecting a command signal on the input lines, (ii) detecting and validating a permission code on the data lines, (iii) decoding the command signal and, on successful validation of the permission code, generating a lock/unlock state for closing any of the switches in response to the decoded signal, and (iv) during the decoding and lock/unlock-state generation, opening the switches, wherein any open switch prevents signals on the corresponding input terminal from reaching the corresponding output terminal; a non-volatile memory for storing the lock/unlock state; and circuitry responsive to the non-volatile memory for operating the switches in accordance with the lock/unlock state; wherein the security device further comprises memory accessible by the decision logic block, and wherein either; the memory accessible by the decision logic block is configured to store a one-time pad base wherein the decision logic block is configured to validate the permission code by comparing the permission code to an entry in the one-time pad base, or; the memory accessible by the decision logic block is configured to store a shared secret, wherein the decision logic block is configured to validate the permission code by comparing the permission code to the stored shared secret.