(Fictional Factual Scenario for Classroom Simulation)
The Firm. Fontaine Financial Corp is a financial holding company headquartered in Durham, North Carolina. It holds banking, investment advisory and broker-dealer subsidiary firms. It has offices all over the U.S.A. and in London, Paris, Brussels and Hong Kong, with its headquarters in Durham, North Carolina. The firm trades publicly on the NYSE and has about 20,000 employees and earns annual revenue of $250 million in and enjoys about a $1 billion market capitalization. The firm was started by David Fontaine’s father in 1970 as a merchant bank in Durham, and has grown into an exciting and thriving part of the Research Triangle.
The Breach. Bruce Carton, the chief financial officer of Fontaine Financial received an email from the CEO, Cynthia Fontaine, to transfer $500,000 to a bank in Atlanta, Georgia. The email is an actual email from the CEO and it appears that someone has stolen her identity. The money is now gone and the IT department says that the fraud is not going to happen again. There is no evidence of these emails in Cynthia or Bruce’s Office 365 account, the email system, which Fontaine Financial uses.
CISO. The new CISO, who reports to the firm’s chief administrative officer, recently replaced the old CISO, who was terminated for handing out IT contracts to friends and family, and perhaps even taking kickbacks. He was also selling Fontaine Financial stock at inappropriate times.
Credit Cards. The broker-dealer subsidiary of Fontaine Financial runs one of the more famous charities in the Research Triangle area, a 5-K run on the Spring, which kicks off a weekend of celebration, dubbed Fontaine Weekend, all to benefit Cancer research. The contributions are collected and managed by Fontaine Financial and include taking credit cards for contributions – this is all done through a collaborative IT platform shared with a local Durham marketing firm.
Cyber Insurance. Fontaine Financial has a cyber insurance policy, but it is a few years old and the GC who negotiated the cyber insurance policy no longer works at Fontaine Financial.
Duke Hospital. Fontaine Financial provides certain financial consulting services for Duke University Hospital, and as part of their philanthropic efforts, manages a Ronald McDonald House attached to Duke Hospital.
Fontaine Financial “Franchises.” Fontaine Financial is an operation that is commonly referred to as an “independent agent model,” somewhat akin to the model used by companies like LPL Financial and the Commonwealth Financial Network. This means that Fontaine Financial engages SEC registered representatives and SEC registered investment advisers like outside contractors who set up their own investment advisory shops across the country. Fontaine Financial provides the compliance system; trading platform; clearance services; and other corporate infrastructure and marketing for each of its outside independent operators. The independent operators all function through the umbrella of Fontaine Financial, which receives a management fee from each independent operator and remotely supervises the office of each Fontaine Financial independent operator. In addition to the independent operators, Fontaine Financial also has some of their own Fontaine Financial branch offices across the country, who are not independent operators but are rather full-fledged Fontaine Financial employees.
Vendors. Fontaine Financial out-sources to quite a few vendors a litany of administrative functions including: payroll services; 40l (K) administration; and a range of aspects of HR. Fontaine Financial also uses Microsoft for all data management, including applications, application development and cloud storage. Fontaine Financial also connects online with all of its fund sponsors such as mutual funds and other investment vehicles.
Data Security Policy. Fontaine Financial maintains a data security policy which all of its independent operators are expected to comply with – however, Fontaine Financial does not audit their independent operators concerning this policy. Moreover, many operators use their own computer networks, printers, etc., social network platforms -- and are even on Mac IOS systems, rather than Windows operating systems.
Incident Response Plan. Fontaine Financial has an incident response plan but has never before had any sort of incident. Carton admits that the incident response plan is boiler plate – and was never really seriously developed.
Prior Transactions and Legacy. Fontaine Financial has recently, over the past several years made a number of acquisitions, and experienced some significant integration issues merging systems from HR to marketing to payroll to financial – in fact, technological integration has been a huge challenge for the company.
Current Transactions. Fontaine Financial has entered into discussions with one of its competitors for a potential merger and is also currently refinancing several loan facilities with its lenders.
SEC Filings. Fontaine Financial has a 10-Q (quarterly reporting form) due for filing in the next couple of weeks.
About John Reed Stark
John Reed Stark
President of John Reed Consulting LLC. Served for 15 years as an SEC enforcement attorney leading cyber-related projects, investigations and enforcement actions; for 11 years as Founder and Chief of the SEC Office of Internet Enforcement; for 15 years as an Adjunct Professor at Georgetown University Law School; for 3 years as Sr. Lecturer of Law at Duke University Law School; for 10 years as a Guest Instructor at the FBI Academy. Worked for 5+ years as Managing Director (three as head of the Washington, D.C. office) of a global digital risk management firm, leading cybersecurity, incident response and digital compliance engagements for corporations and regulated entities. Author of The Cybersecurity Due Diligence Handbook.