Skip to main content

Firewall and Intrusion Detection System

Code: TBD · Credits: 4 · Hours: 60 · Type: ELECTIVE

Firewalls and IDS/IPS systems are still the two most common controls in any defensible network, and they have changed substantially in the last decade — application identification, TLS inspection, behaviour-based detection. This elective covers their architecture, tuning, evasion, and integration into a modern SOC.

Key topics​

  • Stateful and next-generation firewalls (NGFW); application-layer identification.
  • TLS / SSL decryption, the certificate-pinning problem, and selective bypass.
  • IDS taxonomy: signature, anomaly, specification-based, behavioural ML.
  • Snort / Suricata rules and the threat-intelligence pipeline.
  • Evasion techniques: fragmentation, encoding, polymorphism, encrypted C2.
  • WAF, RASP, and protocol-aware proxies.
  • SOAR integration: alert triage, enrichment, response playbooks.

Learning outcomes​

By the end of this subject, a student should be able to:

  • Design a defence-in-depth firewall + IDS deployment for a small Nepali bank.
  • Author and tune Snort / Suricata signatures from a packet capture.
  • Evaluate an IDS evasion case and propose detection enhancements.
  • Integrate alerts into a SIEM with correctly scoped enrichment.

Further reading​

  • Stallings, Network Security Essentials, chapters on firewalls + IDS.
  • The Practice of Network Security Monitoring — Richard Bejtlich.
  • Suricata / Snort / Zeek documentation.
  • MITRE ATT&CK detection-engineering resources.
Chapter notes

Detailed chapter-by-chapter notes for this subject are still being written. The topic outline above mirrors the published syllabus. If you'd like to help draft a chapter, see the contributing guide.

· min read