@ScottMortimer
I would add setting grub password so noone can boot anything from usb device while you are not at your computuer