A network tap providing security for an industrial control system and comprising: a first port connectable to a network carrying industrial control data employing an industrial control protocol; a second port connectable to a control device communicating with an industrial process for control thereof; a software security component; a hardware security component receiving network data packets from the first port and extracting state-less data from the network packets to compare with an allow and reject list in a data table, the hardware security component passing the network packets to the second port if the packet data is in the allow list and not in the reject list and otherwise passing the network packet to the software security component; the software security component comprising an electronic computer executing a stored program to receive network packets from the hardware security component and extract state data from multiple packets according to the industrial control protocol to: identify, based on a set of rules, objectionable packets and reject those objectionable packets without transmitting them to the second port and to load packet data in the reject list identifying future similar objectionable packets for the hardware component; identify allowable first control data packets requiring high speed processing to allow those first control data packets to pass to the second port and to load packet data into the allow list identifying future similar first control packets for the hardware component, wherein control data packets requiring high speed processing have been marked by the industrial control protocol; and identify, based on a set of rules, allowable second data packets not requiring high speed processing to allow those second packets to pass to the second port without loading data into the allow list. a first port connectable to a network carrying industrial control data employing an industrial control protocol; a second port connectable to a control device communicating with an industrial process for control thereof; a software security component; a hardware security component receiving network data packets from the first port and extracting state-less data from the network packets to compare with an allow and reject list in a data table, the hardware security component passing the network packets to the second port if the packet data is in the allow list and not in the reject list and otherwise passing the network packet to the software security component; the software security component comprising an electronic computer executing a stored program to receive network packets from the hardware security component and extract state data from multiple packets according to the industrial control protocol to: identify, based on a set of rules, objectionable packets and reject those objectionable packets without transmitting them to the second port and to load packet data in the reject list identifying future similar objectionable packets for the hardware component; identify allowable first control data packets requiring high speed processing to allow those first control data packets to pass to the second port and to load packet data into the allow list identifying future similar first control packets for the hardware component, wherein control data packets requiring high speed processing have been marked by the industrial control protocol; and identify, based on a set of rules, allowable second data packets not requiring high speed processing to allow those second packets to pass to the second port without loading data into the allow list. identify, based on a set of rules, objectionable packets and reject those objectionable packets without transmitting them to the second port and to load packet data in the reject list identifying future similar objectionable packets for the hardware component; identify allowable first control data packets requiring high speed processing to allow those first control data packets to pass to the second port and to load packet data into the allow list identifying future similar first control packets for the hardware component, wherein control data packets requiring high speed processing have been marked by the industrial control protocol; and identify, based on a set of rules, allowable second data packets not requiring high speed processing to allow those second packets to pass to the second port without loading data into the allow list.