Network Segmentation
A solar plant is rarely one flat network. Behind the site router there is usually the plant control network with the inverters, loggers and telecontrol equipment, and next to it a network for the cameras, one for the alarm and access-control system, and one for the network hardware itself.
The people who work on those networks are rarely the same people. The alarm company needs to reach the cameras. It has no business reaching the inverters.
Network segmentation is how you express that in Mirox: tag each network with what it carries, and each partner reaches only the segments you granted them.
Why this matters for KRITIS and NIS2
Plant control equipment is the part of a solar plant that regulatory frameworks care about. KRITIS and NIS2 expect operators to keep access to it least-privilege and accountable — to be able to answer who could reach the controls, and who actually did.
Segmentation gives you both halves of that answer:
- Least privilege by construction. A partner organization is granted specific segments. Everything else — above all the plant-control network — is not merely hidden from their interface, it is absent from their remote-access routing. They cannot reach it even if they know its address.
- Accountability. Every remote-access session is recorded in the plant's access log: who connected, to which device, when, and for how long. Refused attempts are recorded too.
This lets you bring an external security provider onto a plant without widening their reach to its production equipment, and lets you show exactly that.
The segments
Each network you register in Mirox can carry one or more tags. They are not exclusive — a VLAN that holds both cameras and an alarm panel gets both.
| Segment | What belongs in it |
|---|---|
| Network infrastructure | Routers, switches, firewalls, access points. |
| Cameras | Cameras, NVRs, video encoders. |
| Security systems | Alarm panels, access control, perimeter and intrusion detection. |
| Plant control | Inverters, loggers, telecontrol (SPS). |
Plant control is a restriction, not just a label. A network carrying that tag stays out of reach for a segment-restricted role even if it also carries a tag that role is granted — because a camera sharing a VLAN with the plant controller does not make the plant controller safe to expose.
Untagged networks
A network with no tags is unclassified. Nothing changes for your own team: your operators, technical and commercial managers reach unclassified networks exactly as they always did.
But a role whose reach is defined by segments cannot enter an unclassified network. That is deliberate. Nobody has said what is on it, and on a solar plant an unlabelled network may well be carrying inverters — so Mirox does not guess.
The practical consequence: after you grant someone the Security Officer role, tag the networks they should reach. Until you do, they will see nothing.
The Security Officer role
Security Officer is the first role whose reach is defined by these tags. It is built for an external service provider for alarm, CCTV or perimeter systems:
- Reaches the network devices in its granted segments, over both remote-access paths — the device proxy and the personal VPN.
- Reads the plant's access log, so the provider can see their own trail.
- Can raise and follow tickets on what they find.
- Sees no production, performance, revenue or contract data at all — those parts of Mirox do not exist for this role.
- Never reaches a plant-control network.
The role is granted per plant or per portfolio, or shared through a cooperation with the partner's own organization. No organization role turns into it by itself.
Ask the provider to enable 2FA before the first visit
A Security Officer works over remote access only, so two-factor authentication (2FA) matters more for this role than for any other. The device proxy always requires 2FA on the user's account and a live sign-in. And if the organization that owns the plant requires 2FA, the plant stays hidden in Mirox until the provider's user has a second factor. The personal VPN is based on a certificate and does not depend on 2FA.
Setting it up
- Open the plant's network settings and tag each network by what it carries. You can do this while creating a VPN connection, or afterwards on an existing one.
- Grant the partner the Security Officer role — on a single plant, on a portfolio, or through a cooperation with their organization.
- Check the result on the plant's device list: the partner sees only the devices inside their segments.
Tags can be changed at any time. Removing a tag takes the network out of reach on the partner's next connection; adding one opens it. You do not need to re-issue any credentials.
Related
- Permission System — the roles these segments apply to.
- Organization Security Policy — when a second factor is required to see a plant.
- Access Log — who reached what, and when.
- Cooperation Restrictions — limits on what a partner organization can be granted.
- Remote Access — how the device proxy and the personal VPN reach a plant.