start------>settings ---> control panel -------> user accounts

You can assign your son an user accounts with limited rights. Firewall would block any download but I don't know how good would be an firewall if an user has an administrative rights. One more thing you can put an password in your firewall settings. So if some one wants to go around it, they cannot without authentication. ZoneAlarm, Sygate, Norton, etc.etc they are all good, if you know how to manage them.