Discussion on:

Protect small business clients from making these mistakes

That's one I see all the time, even though my clients are software developers! Trusting Windows Firewall to save you is not my idea of security...

I regularly disable USB ports (particularly front-panel ones) and CD/DVD drives unless there is a bona-fide reason for a particular user/station to have them. This reduces the threat of data theft, users attempting to add unauthorized software, or introducing viruses/spyware onto their computers or the network.

Since most software is installed via the network or Internet, it's rare to need these drives in most of the environments I oversee.

USB ports can be disable in the BIOS setup. I order/configure most workstation without CD/DVD drives.