Evading IDS, Firewalls, and Honeypots

1. Firewalls as Policy, Not Magic

Allow/deny lists, stateful inspection — configure YOUR lab firewall.

2. IDS/IPS: Signatures vs Anomalies

Alerts are clues. Tuning beats “turn it off.”

3. Honeypots as Tripwires

Decoy systems defenders use — you will not attack someone else’s honey.

4. Lab — Write Firewall Rules for YOUR Lab VM

Document inbound allow for SSH/HTTP you need; default deny notes.

5. Quiz — Firewalls and Detection

10 APPLY questions on defense devices without evasion steps.