A cyber-security system, including a device and associated method, provides secure communications bi-directionally between an external network and an internal network, including a supervisor control and data acquisition (SCADA) device. The device includes a processor in data communication with the external and internal networks that is programmed with a rule-set establishing validation criteria configured to validate data received from the external and internal networks. The processor is operable in an operational mode to pass between the external and internal networks only data that are compliant with the validation criteria. The processor may be configured to save certain validated data indicating a system state that can inform the application of the rule-set to data. The processor is re-programmable with a new rule-set only in a programming mode. The device includes a switch that is manually operable to switch the processor from the operational mode to the programming mode.