There is some debate going on among my peers. With differing opinions regarding risk on infected thumb drive with limiting policies set on it.

Question is Can you still get an infection with read only access, disable write on thumbdrives. How about disable execute access only.

My thoughts is that if you disable write. Higher risk as AV cannot clean the thumbdrives but you can still get an infection from read only drives. Disabling execute reduces the risk but infection can still occur. Plus side is AV can clean/quarantine if required. Read only serve no purpose apart from preventing writing files to the thumbdrives.

Thoughts?