Monitoring Communication Networks of Energy Grids With the Open-source Framework...
summary
A hands‑on deployment story of an open source passive monitoring stack that the BSI pushes into critical infrastructure: Malcolm in the middle pairs lightweight network sensors (mirror or fail‑open taps) with a Dockerized server running Zeek + Suricata + Arkime feeding OpenSearch/OpenSearch Dashboards. BSI contributes MISP integration and IEC 104 parsers (GOOSE parsing under review). Several utilities (wastewater, electric sites) run it successfully but usability, training needs, lack of vendor support and sensor placement remain the main barriers to broad production use.
AI-written summary · about
chapters (10)
- 0:00Introduction to monitoring energy grids
- 2:59Why monitor communication networks
- 10:18Malcolm framework overview
- 14:10How Malcolm processes network data
- 18:29BSI's road show and benefits
- 21:00Challenges in energy sector adoption
- 24:56Vendor ecosystem and open-source challenges
- 27:07Comparing Malcolm with other tools
- 29:05OT environment deployment considerations
- 30:20Q&A and closing remarks
related talks
33mFree SOC? — how open source tools can come to our aid
06mFrom Sensors to Insights: Building an Open Observability Pipeline for Industrial Systems
43mBuilding a network security practice in your organization | Pannel Discussion
33mWhen Observability Meets Sustainability: A Real World Experience
04h 02mOpen-source Tools for CSIRTs
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
01h 27mOpen-source Tools and CSIRT Success Stories
50mJoin the Mission to Strengthen the Industrial Ecosystem