Box 6.4 Outsourcing ICT in the health service The health service relies on private service providers to develop and introduce solutions and provide service, maintenance and operation. Inadequate procedures and risk assessments were discovered while South-Eastern Norway Regional Health Authority was in the process of outsourcing operation of its ICT infrastructure to an international provider. Outsourcing to external system operators requires control measures and risk and vulnerability analyses to ensure that personal data processing requirements are met. The Ministry of Health and Care Services will therefore initiate work to examine information security management when using private sub-contractors in the health sector. The Government wants businesses to be aware when outsourcing ICT services and to follow national advice and recommendations. Several guidelines have been prepared by the Norwegian Data Protection Authority, the Directorate for Administration and ICT (Difi), the Directorate for eHealth, NorSIS and Uninett, among others, to help businesses that are considering outsourcing. NSM will also prepare a report on outsourcing in 2017. 6.5 Intrusion tests Identification and attempts at intrusion take place continuously towards devices connected to the internet. Intrusion testing is an efficient tool to identify vulnerabilities and test the resilience of ICT systems. This is done through targeted search, analysis and attempted exploitation of vulnerabilities, faults and defects. Vulnerabilities in infrastructure connected to the internet may also be detected by using mapping tools, such as Allvis NOR (see box 6.5). Box 6.5 Allvis NOR National states, organisations and private individuals identify vulnerabilities from the internet. In Norway, the general public were made aware of this phenomenon through daily newspaper Dagbladet’s series of articles on “Zero CTRL” in 2013/2014. Since then NSM has established a similar mapping service, Allvis NOR. Allvis NOR searches through affiliated businesses’ internet-exposed ICT interfaces to detect vulnerable or incorrectly configured services and equipment, so that the enterprise itself can reduce its vulnerabilities. The service is consent-based. Allvis NOR was further developed to be able to detect the specific vulnerability that was used by the ransom virus referred to as “WannaCry” in May 2017. NSM experienced an increased demand for the service during this incident. Allvis NOR provides the authorities with insight into the state of the public sector in Norway’s internet security and ensures that the development can be monitored over time. Allvis NOR will be a useful supplement to ordinary intrusion testing and will help improve basis security in society. The Ministry of Justice and Public Security recommends use of intrusion tests. A number of businesses have followed the recommendation, and in most cases have revealed serious vulnerabilities and helped them to be dealt with.