I regularly disable USB ports (particularly front-panel ones) and CD/DVD drives unless there is a bona-fide reason for a particular user/station to have them. This reduces the threat of data theft, users attempting to add unauthorized software, or introducing viruses/spyware onto their computers or the network.

Since most software is installed via the network or Internet, it's rare to need these drives in most of the environments I oversee.

USB ports can be disable in the BIOS setup. I order/configure most workstation without CD/DVD drives.