A cyber-security device for providing secure communication of automation and control messages between first and second networks (34, 38) in a system operable in one or more system states, the cyber-security device comprising: a first network interface (36, 40) configured to accept messages destined for the second network (34, 38), and to transmit qualified and validated messages to the first network (34, 38) from the second network (34, 38); a second network interface (36, 40) configured to accept messages destined for the first network (34, 38), and to transmit qualified and validated messages to the second network (34, 38) from the first network (34, 38); a processor configured in an operational mode to qualify and validate messages from the first and second network interfaces (36, 40) on a byte-by-byte basis; and memory configured to store a rule-set comprising rules for qualifying and validating messages on a byte-by-byte basis, wherein at least one of the rules is a system state-dependent rule; wherein the processor is operable in the operational mode to: accept a message from the first network interface (36, 40); retrieve the rule-set from memory; receive data including system state information; qualify the message from the first network interface (36, 40), on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface (36, 40) only if the message is validated and in compliance with the system state-dependent rule. a first network interface (36, 40) configured to accept messages destined for the second network (34, 38), and to transmit qualified and validated messages to the first network (34, 38) from the second network (34, 38); a second network interface (36, 40) configured to accept messages destined for the first network (34, 38), and to transmit qualified and validated messages to the second network (34, 38) from the first network (34, 38); a processor configured in an operational mode to qualify and validate messages from the first and second network interfaces (36, 40) on a byte-by-byte basis; and memory configured to store a rule-set comprising rules for qualifying and validating messages on a byte-by-byte basis, wherein at least one of the rules is a system state-dependent rule; wherein the processor is operable in the operational mode to: accept a message from the first network interface (36, 40); retrieve the rule-set from memory; receive data including system state information; qualify the message from the first network interface (36, 40), on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface (36, 40) only if the message is validated and in compliance with the system state-dependent rule. accept a message from the first network interface (36, 40); retrieve the rule-set from memory; receive data including system state information; qualify the message from the first network interface (36, 40), on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface (36, 40) only if the message is validated and in compliance with the system state-dependent rule.