While the question of completely disabling usb-controllers and -storage to defeat an evil-maid-attack has already been answered here quite often, I have a different solution in mind.
Upon locking the GUI, the system would
- iterate over the already connected usb devices,
- lock all other ports, and
- while being locked check the connected devices
If a device is removed from the system, a specific action is taken like locking all usb-ports or powering down the system. This would obviously not prevent a skilled attack, but would prevent the literal evil-maid (technically unversatile person with physical access, which has been instructed to "just plug this thing between keyboard and computer").
Anyone knows if a script doing that already exists?
Sidenote: Yes I know of Law 3, that this does not provide complete security, yadayada. Still, a good line of defense means to have several moving parts and having this script would increase the physical security in environments, where you are unable to do more (yes those exist).