I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are disconnected from the Internet so the only way for data to be taken without authorization would be for a user to bring in a hard drive, connect it, and transfer the data.
I know that I can mitigate this to some degree by disabling the SATA and USB ports in the BIOS and setting up a BIOS password. However, the BIOS settings can be reset via the jumper. The only option I can think of that could prevent this threat would be through the destruction of the ports themselves, perhaps through the use of something like super glue.
Do I have any other options, that would not cause physical damage, to prevent data from being transferred via a drive that someone brought in and connected?