If I was your son, the ONLY way to prevent booting from a DVD is to physically remove the drive. (google DVD drive replacement and your laptop's model number. It's usually just a few screws to get to it and takes about 30 seconds. Keep the drive in your car locked and check it daily, or just leave at your office)
- Even if you put a BIOS password on it I would clear it.
- The only other issue with this is the USB ports/SD Card slot.
If he was to create a USB bootable drive he would still be able to boot that, however you would physically see the USB drive plugged in, OR he could do the same thing on an SD card which you would have to physically look into the SD card slot.
Regardless of disk encrypting and attempts of physical security it sounds like your son is already one of us (security minded engineer) since physical access is the killer to all security measures you may want to just buy a cheap computer or laptop off of craigslist or ebay and have it be theirs. To limit time on their machine, take the power cord (and battery as well if a laptop) when you don't want them using the machine.
If you want to limit what they can access online then buy a decent router and block traffic on that level. Change the password to administer the router to something EXTREMELY random like "!S!@$#wf¥V║e@f#f3#$f3" and check every week that he didn't reset the router back to defaults to overcome this. (If I was your son I might just leech access off of one of the neighbors, so again there is a way around almost everything.) to get really secure on online access pull their wifi card so they have to be physically connected with the onboard network card and keep an eye open for a USB wifi adapter that he might sneak on onto it to try to bypass that security measure.
Depending on your son's age and moral values he has the potential to become a good producer in a modern society, please don't hold them back since most introverts tend to hold a grudge he will remember how you treat him on this issue. Give them their own computer and chances are if he's that bright with electronics have them help find and buy a broken system (together) for pennies on the dollar and rebuild it, your son might just suprise you and start a side business repairing machines while hopefully staying out of trouble.
good luck, and I hope my son (who is 2 years old right now) grows up to become like your son, which is coincidently similar to how I grew up.
By the way, when I was grounded as a kid the only way my parents could keep me off my computer was to take ALL of the cords, since I bought a few spare cords as well I would still bypass this security measure in the middle of the night or when I knew that they would be working late. Point being, with physical access all bets are off on security, it's only a matter of time to bypass it.
My apologies that I have talked about getting around every single security measure, I do this so that you don't have false hopes on keeping them out. Working in I.T.Sec isn't for everyone since it takes a certain deductive reasoning mindset, point being nothing is truly impenetrable. I'm just being accurate. And if your son had his own laptop you could always take it away from him (or if you are really upset shoot it like that father did on youtube http://youtu.be/kl1ujzRidmU )