Norsk helsenett SF’s Vulnerability Disclosure

Norsk helsenett SF develops, operates and maintains digital services that are fundamental to the Norwegian health system. Norsk helsenett SF has a strong focus on security and privacy, and therefore values the input of hackers acting in good-faith to help us maintain a high standard for our services. This guideline describes the target, scope and acceptable process for reporting vulnerabilities that you detect in our solutions.

Expectations

By complying with this policy, you can expect the following from us:

• Cooperate with you to understand your findings
• Fix vulnerability as soon as possible after a thorough assessment
• Recognition of your contribution

Scope and target

The scope includes all services under

• *.helsenorge.no
• *.nhn.no

If you have any questions regarding the scope, you can contact us at securityATnhnDOTno. When reporting a vulnerability, please provide assessments regarding the attack vector, attack scenario and negative impact of the vulnerability.

Scope out

The followings are NOT in the scope and shall NOT be attempted to perform:

• All forms of attack that can lead to disruption of our services (e.g. DoS/DDoS)
• Attacks that modify content of the web page or user’s data.
• Social engineering techniques or phishing campaigns

Reward

Norsk Helsenett SF, being a public organization, does not offer financial rewards for the discovery of vulnerabilities. However, ethical hackers who help in discovery of vulnerabilities may earn recognition in our Hall of Fame. To be included, please explicitly state in your email that you wish to be acknowledged in our Hall of Fame and specify the name or nickname you prefer to be recognized by.

Compliance rules

As part of encouraging vulnerability research and distinguishing between well-intentioned security testing and destructive cyberattacks, you shall comply to the followings:

• Adhere to the rules of this guideline
• Report vulnerabilities you have identified as soon as possible
• Avoid violating privacy, disruption of services, sabotaging solutions or modifying data
• Use only official channels to discuss vulnerabilities with us
• If a discovered vulnerability gives you access to personal data, limit the amount of data you access and notify us as soon as possible
• Blackmailing is not tolerated
• You are expected to comply with Norwegian law