Check out Neil Rubenking's review of NIS 2010 in PC Magazine. He was pretty thorough with explaining the new features.
What he had to say about the Firewall:
Well-Rounded Firewall
As expected, based on past performance, Norton's firewall passed all Web-based attack tests. Its program control never pesters the user with heavy-duty security questions. Instead, it allows Internet access for known good programs, deletes known bad programs, and keeps an eye on the behavior of unknowns. That means you never get a confusing query from the firewall.
I typically test for advanced program control by running leak tests—utilities that exercise sneaky techniques used by malware to evade normal program control. Norton's firewall doesn't react to these because they have no actual malicious payload, though AutoProtect blocks some as known nuisances and SONAR blocked others based on behavior.
Norton includes specific behavioral signatures to help it block attacks on almost 700 known vulnerabilities in browsers, the operating system, and other programs. It also recognizes and blocks well over a thousand Web-based exploits. I tested it using the Core IMPACT penetration tool and it blocked every sample exploit I threw at it. A tiny temporary window announced each blocking event even when the up-to-date test system wouldn't have been vulnerable. Clicking that notification opened a new window with tons of technical detail about the attack.
The firewall is totally tamper-proof, as far as I can tell. It actively blocked all my attempts to kill processes, disable services, change essential Registry entries, and more. Malware is not going to switch off this firewall's protection.—
--TD
"The brain is useless. We must find another brain." Dr. Henry Frankenstein (1932)
