As a first responder to a suspected DoS incident, the initial step is to make an assessment of the situation. This involves analyzing the network traffic using tools like Wireshark to confirm the nature of the traffic and determine if it is indeed a DoS attack. The assessment will help in understanding the scope and impact of the incident and is crucial for deciding the subsequent steps in the response process.

Steven should implement Network Address Translation (NAT) on the firewall to ensure that the IP addresses of the workstations are private and not directly accessible from the public Internet.
NAT translates the private IP addresses of the workstations to a public IP address before they are sent out to the Internet, and vice versa for incoming traffic. This not only hides the internal IP addresses but also allows multiple devices to share a single public IP address, which is essential as the company grows.