Epoxy is a pain, just use a sticky connector envelope instead. USB disconnect disabling whole USB host is trivial to code. You would disable on disconnect inst

Epoxy is a pain, just use a sticky connector envelope instead. USB disconnect disabling whole USB host is trivial to code. You would disable on disconnect instead of whitelisting as there can be USB host bugs. Add a boot password so that only admin can start the machine... Plus the are solutions where drivers are also put in a VM to further reduce attack surface.