Lakewood Community Bank

Scenario: On a Monday morning, Operations Manager David Reyes receives what appears to be an urgent email from Chief Lending Officer Patricia Greene (patricia.greene@lcbankohio.com — domain spoofed; LCB's DMARC policy is "none"). The email instructs the wire room to process an emergency $187,500 wire to a new payee (Riverside Holdings LLC, routing to a Lithuania correspondent bank) for "construction loan funding — time-sensitive, do not delay." A wire operator processes the wire using the standard workflow — no dual-control verification, no callback to the CLO. The wire clears Fedwire at 9:47 AM. At 10:15 AM, Patricia Greene calls David Reyes asking about a loan document — she never sent any wire instruction.

• What immediate containment actions are possible once the fraudulent wire is identified? What is the Fedwire/SWIFT recall process and its typical success rate after the wire has cleared?
• Which specific policy violations and control gaps enabled this attack? Which C2M2 domains are directly implicated?
• LCB's DMARC policy is "none" — how does this enable email domain spoofing? What SPF/DKIM/DMARC configuration should LCB implement, and what is the implementation cost and timeline?
• What FinCEN Suspicious Activity Report (SAR) filing obligations exist for a confirmed BEC wire fraud event? What is the filing timeline?
• How should LCB redesign its wire transfer workflow — including technological and procedural controls — to prevent recurrence without unacceptably slowing legitimate wire operations?

Scenario: At 2:30 AM Saturday, an after-hours email alert from ManageEngine EventLog Analyzer fires to IT Director Kevin Merritt — flagging unusual outbound traffic from the VLAN 1 segment. Kevin is asleep and doesn't see the alert until 7:00 AM. By then, ATM transaction logs (reviewed Monday after the branch manager reports empty cassettes) show that ATMs FAC-02-ATM-01 and FAC-04-ATM-01 — both Windows 7 EOL units — dispensed their entire cash cassettes ($48,000 combined) between 2:15 and 2:45 AM. Physical inspection shows no signs of forced entry or card skimming. The ATMs' Windows 7 event logs show a remote RDP connection from an internal IP (10.1.18.42 — SRV-08, the RealTime ATM Manager server) exactly 11 minutes before the cash-out sequence began.

• What does this attack chain suggest about how the attacker moved from initial network access to ATM jackpotting? Which specific network architecture gap enabled lateral movement from initial access to the ATM Manager console to the ATMs?
• LCB had no 24/7 monitoring. What is the minimum after-hours monitoring capability a community bank processing daily ATM cash should maintain? What would the after-hours SOC model cost?
• What evidence preservation steps must occur before systems are remediated? Who leads the forensic investigation — LCB IT staff, the MSP (NetSol), or an external firm?
• What OCC notification obligations apply following a significant operational incident involving customer fund loss? What is the reporting timeline under GLBA §314.6?
• Which three specific C2M2 domain gaps most directly enabled this incident? For each, identify the specific practice that was not in place.

Scenario: On a Thursday afternoon, Jack Henry & Associates issues a security notice to all Silverlake clients: a threat actor exploited a vulnerability in the Jack Henry remote support VPN infrastructure and gained unauthorized access to client environments through persistent support VPN sessions. Jack Henry cannot confirm which specific client environments were accessed or what data may have been exfiltrated. Jack Henry's own log retention covers only the last 21 days. LCB's Jack Henry support VPN has been always-on and unmonitored for 3 years. That VPN session has privileged access to the Silverlake core banking database — which contains account numbers, SSNs, balances, and transaction history for all 22,400 LCB customers.

• What are LCB's immediate containment actions? How do you terminate the Jack Henry VPN without disrupting Silverlake core banking operations during active business hours — and what are the operational consequences if you cannot?
• Under GLBA §314.6 (2023 Safeguards Rule), LCB must notify its primary federal regulator (OCC) within 30 days of becoming aware of a notifiable event. Does this incident trigger that requirement? Who at LCB prepares the OCC notification, and what must it contain?
• What customer notification obligations apply under GLBA and applicable state breach notification law (Ohio Rev. Code §1349.19)? What triggers the notification clock — the Jack Henry notice, or LCB's own investigation conclusion?
• How do you assess the scope of potential data exposure given that Jack Henry's logs only go back 21 days and LCB has no monitoring of VPN session activity?
• What contractual provisions should LCB have required in the Jack Henry agreement that would have limited this risk? Which specific C2M2 THIRD-PARTIES practices would have provided early warning or reduced exposure?