A bank acquired a fintech and wants both networks joined in 30 days so staff can share systems. The fintech network is flat, runs legacy protocols and was never assessed. What should the security manager do FIRST?
A. Deploy a default-deny firewall between the networks
B. Assess the fintech network and define trust boundaries
C. Segment the fintech network and retire legacy protocols
D. Route cross-network traffic through the bank's monitored proxy
(Explain your answer for more points in the comments!)