You are the IT Security Manager at a mid$-$sized company. The company has recently adopted a bring your own device $($BYOD$)$ policy.

One of your employees, John, has been using his personal device for work$-$related tasks. John's device gets infected with malware, which he unknowingly connects to the company's network. As a result, the malware spreads across the network, compromising sensitive data.

As the IT Security Manager, what should be your immediate course of action?

answer

Immediately fire John for causing a security breach.

Ignore the issue as it's John's personal device and not the company's responsibility.

Publicly blame John for the incident to set an example for other employees.

Disconnect John's device from the network, isolate the affected systems, and start an investigation to understand the extent of the damage.