Commscope’s CISO on turning ransomware into resilience and strengthening IT/OT controls

In this Security Edge interview, Ahmad Douglas, Commscope’s CISO, reveals how a major ransomware attack reshaped his approach to cyber resilience and leadership under pressure.

Commscope, a company that employs 30,000 people, was hit by a ransomware attack orchestrated by a gang called Vice Society.

Sensitive data, including employees’ personal and financial information was stolen, shaking the organisation.

This attack was a baptism of fire for Ahmad, who had spent a decade as a business information security officer but was now navigating his first CISO position.

The experience quickly pushed him to make rapid decisions under pressure and coordinate a response without the benefit of finalised incident response plans or full internal resources.

Ahmad’s response to the attack demonstrated both resourcefulness and strong leadership.

Without an established incident response retainer in place, he leveraged his network, calling his former boss to quickly involve Mandiant, a top-tier security firm, to help manage the situation.

He also sought advice from experienced leaders like Jamil Farshchi, who had managed the fallout from the Equifax breach in 2017.

Ahmad emphasised the importance of relationships in the cyber security field, not just for technical problem-solving, but for establishing communication with executives, maintaining calm in crises and securing the trust of senior leadership.

The lessons learnt helped him establish protocols for future incidents and highlighted the need for comprehensive playbooks, crisis communications, and even ransom negotiators.

The cyber attack on Commscope served as a turning point that enhanced the visibility of the CISO role, previously lacking direct engagement with key stakeholders.

Ahmad built trust through transparent and consistent security initiatives, gradually earning the confidence of senior leadership and enabling direct discussions with the board and CEO.

His incremental approach to cyber risk reduction emphasised continuous improvement and aligned security with business objectives, establishing cyber security as a driver of long-term success rather than merely a cost centre.

Ahmad also highlights the significance of fostering an authentic and supportive workplace culture focused on curiosity and continuous learning, despite financial constraints, and advocated for transparency in cyber security to build customer trust, especially during critical incidents like ransomware attacks.

Key takeaways:

• Authentic and supportive culture: Fostering an open and authentic culture where employees are valued and encouraged to grow, even if it means celebrating when they move on to better opportunities.
• Investment in learning: Emphasising the importance of continuous learning by investing in employee training and certifications, which helps retain people who share similar values despite financial constraints.
• Transparency in cyber security: Advocating for strategic transparency during cyber security incidents to build trust with customers, particularly by oversharing relevant details while maintaining legal considerations.