A company recently experienced a security incident in which a USB drive containing malicious software was able to covertly install malware on a workstation. Which of the following actions should be…

A host-based IDS (Intrusion Detection System) can detect an intrusion, but it may not prevent the initial infection from an AutoRun USB and is more reactive than preventative in this specific scenario.

Restricting log-in times controls when a user can access a system, but it does not prevent malware from a USB drive from installing if the user is logged in.

Enabling a BIOS password protects the system's firmware settings and prevents unauthorized booting from other devices, but it does not prevent malware from installing via a USB drive once the OS has started and the user has logged in.

Updating password complexity strengthens user authentication but does not directly prevent malware installation from a USB drive.

Disabling AutoRun (or AutoPlay) for USB drives prevents malicious software on a USB drive from automatically executing when the drive is inserted, thereby mitigating a common initial infection vector.

Restricting user permissions to only those necessary (Least Privilege Principle) ensures that even if malware from a USB drive attempts to install, it will be blocked from making system-wide changes that require administrative rights.