A company recently experienced a security incident in which an unauthorized user was able to insert a USB flash drive into a kiosk, launch a non-native OS, and deliver malicious payloads across the…

Host-based antivirus operates within the installed OS and cannot protect against a threat that boots an entirely different OS from an external USB device before the native OS loads.

Automatic screen locks address unauthorized access to an already-running session and do not prevent an attacker from rebooting the machine from an external USB device.

A strong BIOS/UEFI password prevents unauthorized users from accessing firmware settings and changing the boot order, which directly stops an attacker from configuring the system to boot from an inserted USB drive before the native OS loads.

Disabling AutoRun for USB devices prevents the operating system from automatically executing programs or scripts when a USB drive is inserted, directly blocking the delivery mechanism used to spread malicious payloads across the network.

Secure Boot helps prevent unauthorized boot loaders but does not stop AutoRun from executing malicious payloads if the attacker uses the USB while the system boots normally; C and D together address both vectors of this specific attack.

Changing default administrator credentials improves general account security but does not prevent a USB-based boot attack or the automatic execution of malicious payloads.