A newly acquired company has an internet-facing device running unsupported firmware with no available patch. What best reduces immediate exposure while replacement is arranged?

1. Wait for evidence of exploitation before acting
2. Remove direct internet access and restrict necessary access
3. Rename the administrator account only
4. Disable vulnerability scanning for that device