A cyber-security device for providing secure communication of supervisor control and data acquisition, SCADA, or automation protocol data messages between an external network and an internal network, the cyber-security device comprising: an external communication interface configured to send data messages to, and receive data messages from, the external network; an internal communication interface configured to send data messages to, and receive data messages from, the internal network; characterized by a processor in communication with the external communication interface and the internal communication interface, the processor being switchable between a programming mode and an operational mode, the processor being operable in the operational mode to process the data messages in accordance with a processor-implemented rule-set configured for (a) qualifying, byte-by-byte, (i) the content of each of the data messages received from the external network via the external communication interface as conforming to qualification criteria defined by the rule-set for external-to-internal communications, and (ii) the content of each of the data message received from the internal network via the internal communication interface as conforming to qualification criteria defined by the rule-set for internal-to-external communications, and (b) validating, byte-by-byte, the content of each qualified data message to determine data message validity in accordance with the rule set, (c) passing to the internal communication interface qualified and validated data messages received from the external communication interface, and (d) passing to the external communication interface qualified and validated data messages received from the internal communication interface; wherein the processor is re-programmable with a new rule-set only in the programming mode, whereby, in the programming mode, the processor is configured to load a new rule-set, and, after loading the new rule-set, to cycle to the operational mode; and a switch operable manually to switch the processor from the operational mode to the programming mode. an external communication interface configured to send data messages to, and receive data messages from, the external network; an internal communication interface configured to send data messages to, and receive data messages from, the internal network; characterized by a processor in communication with the external communication interface and the internal communication interface, the processor being switchable between a programming mode and an operational mode, the processor being operable in the operational mode to process the data messages in accordance with a processor-implemented rule-set configured for (a) qualifying, byte-by-byte, (i) the content of each of the data messages received from the external network via the external communication interface as conforming to qualification criteria defined by the rule-set for external-to-internal communications, and (ii) the content of each of the data message received from the internal network via the internal communication interface as conforming to qualification criteria defined by the rule-set for internal-to-external communications, and (b) validating, byte-by-byte, the content of each qualified data message to determine data message validity in accordance with the rule set, (c) passing to the internal communication interface qualified and validated data messages received from the external communication interface, and (d) passing to the external communication interface qualified and validated data messages received from the internal communication interface; wherein the processor is re-programmable with a new rule-set only in the programming mode, whereby, in the programming mode, the processor is configured to load a new rule-set, and, after loading the new rule-set, to cycle to the operational mode; and a switch operable manually to switch the processor from the operational mode to the programming mode.