At the heart of the problem is the deficit in full comprehension of the complexity of cybersecurity and how it works . “ It is very difficult to detect . We just know that it ’ s there ,” Lujan said .
“ Where it is — that ’ s kind of the big question .”
Cover story
CONTINUED FROM PAGE 18
in plain sight , lurking and blending into normal environments , making it a formidable challenge to detect , let alone , mitigate .
Cybersecurity is a multifaceted challenge involving interconnected digital infrastructure , highly motivated cybercriminals and a diverse range of threats . Technological advancements and the prevalence of connected devices add further complexity , necessitating continuous adaptation and the use of cutting-edge strategies and tools .
But even cybersecurity experts are unable to paint the complete picture . It remains unclear if Volt Typhoon was involved in the cyberattacks on Guam Memorial Hospital and Docomo Pacific , which caused an internet outage in March .
“ It is much more complex . How they got in is actually more organic . It is just something that is there that is taken advantage of ,” Lujan said . “ Other than knowing that there were areas within Guam that affected our infrastructure , we have no evidence yet that we hadn ’ t been penetrated .”
At the heart of the problem is the deficit in full comprehension of the complexity of cybersecurity and how it works . “ It is very difficult to detect . We just know that it ’ s there ,” Lujan said . “ Where it is — that ’ s kind of the big question . Right now , we have everything , all the tools in place , to try and look for those indicators of compromise . But at this point , we still don ’ t see it .”
In a report released on the day Typhoon Mawar hit Guam , Microsoft said it had uncovered “ stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States .
The attack is carried out by Volt Typhoon , a state-sponsored actor based in China that typically focuses on espionage and information gathering ,” Microsoft said .
Gov . Lou Leon Guerrero speaks at the 2024 Central Pacific Cybersecurity Summit hosted by the Guam National Guard at the University of Guam on Nov . 6 , 2023 . Photo courtesy of U . S . National Guard / Mark Scott
At the heart of the problem is the deficit in full comprehension of the complexity of cybersecurity and how it works . “ It is very difficult to detect . We just know that it ’ s there ,” Lujan said .
Lt . Col . Bumjin Park , chief information officer for the Guam Guard , agreed that the Volt Typhoon offensive was a highly sophisticated operation that used “ built-in Microsoft tools that clutter TV and internet , making it difficult to detect . “ So , it ’ s a costly experience with that situation ,” he said .
The only thing that ’ s clear is the vulnerability and weaknesses of Guam ’ s cybersecurity program , according to Leon Guerrero .
Cybersecurity experts have held a series of cyber conferences on Guam to “ solidify and prevent future cyberattacks .” At the 2024 Central Pacific Cybersecurity Summit hosted by the Guam National Guard from Nov . 6 to 7 , more
“ Where it is — that ’ s kind of the big question .”
than a hundred cybersecurity stakeholders gathered at the University of Guam .
The Department of Defense earlier acknowledged that the malicious computer code installed by state-sponsored Chinese hackers could disrupt U . S . defense operations on military bases . The Microsoft report said Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States . In an article in June , the New York Times quoted an unnamed congressional official , who warned that the Chinese malware was essentially “ a ticking time bomb ” that could give China the power to interrupt or slow American military deployments or resupply operations by cutting off power , water and communications to U . S . military bases .
“ What we want to do is protect and make a solid plan and solid actions to strengthen our cyber deterrence ,” the governor said . “ Integrated deterrence is a watchword over at Indo-Pacific Command . This is the work we are doing here today . I am optimistic about the future of our island , one that doesn ’ t fear the digital age , but one that embraces it .”
The latest cybersecurity conference saw the gathering of representatives from the U . S . Indo-Pacific Command ,
CONTINUED ON PAGE 21
20