An IoT device deployed in a smart city infrastructure project begins transmitting data at an...

ECIH v3 incident handling principles place containment ahead of eradication and recovery when a potentially compromised device is actively generating suspicious traffic. Immediately isolating the affected IoT device prevents further unauthorized communication, limits lateral movement, and reduces the possibility that the device will affect other components of the smart-city infrastructure. Because the device supports safety-sensitive functions such as traffic monitoring and street-light control, containment should be targeted rather than unnecessarily disrupting the entire environment. Contacting the manufacturer may support later investigation, while updating firmware is an eradication or hardening measure that should follow evidence collection and incident validation. A public-awareness campaign does not address the active compromise. Therefore, immediate network isolation provides the most effective first-response action.

================