📚 Topics Covered — All 5 Domains
Collapse/expand each domain. Futurama characters guide you through every objective.
Fry's Guide to Fundamentals: Even a 20th century delivery boy can learn these!
- CIA Triad: Confidentiality, Integrity, Availability
- Non-repudiation — Can't deny you pressed the launch button
- Security Controls: Preventive, Detective, Corrective, Deterrent, Compensating
- Control Types: Managerial, Operational, Technical
- Least Privilege — Only Leela pilots the ship
- Separation of Duties — Hermes AND the Professor must approve experiments
- Defense in Depth — Multiple layers from hangar to cockpit
- Zero Trust — Even crew members need to re-verify
- Gap Analysis, Change Management, Supply Chain Risk
- Cryptographic concepts: hashing, salting, symmetric vs asymmetric
- PKI, certificates, CA hierarchy, CRL, OCSP
Bender's Threat Handbook: Bender embodies the insider threat so you understand them all.
- Threat actors: Nation-state, criminal, hacktivist, insider, script kiddie
- Social engineering: Phishing, vishing, smishing, spear phishing, whaling
- Malware: Ransomware, worms, trojans, RATs, rootkits, spyware
- Application attacks: SQLi, XSS, CSRF, buffer overflow, injection
- Network attacks: DDoS, MitM, DNS poisoning, VLAN hopping
- Vulnerability scanning, CVSS scoring, zero-day, CVE
- Physical attacks: Tailgating, shoulder surfing, dumpster diving
Professor Farnsworth's Design Lab: "Good news, everyone — this architecture is secure (mostly)!"
- Cloud models: IaaS (Hangar), PaaS (Slurm Factory), SaaS (Holoshed)
- Shared responsibility model
- Network segmentation, DMZ, screened subnet
- VLANs, SD-WAN, SASE, Zero Trust Architecture
- Secure design principles: Fail secure, least functionality, isolation
- On-prem vs cloud vs hybrid
- Load balancers, HSMs, TPMs, jump servers
- Containerization, microservices, serverless
- Data protection: encryption at rest, in transit, in use
Leela's Ops Command Center: One-eyed vision sees all threats clearly.
- Identity & Access Management: MFA, SSO, PAM, directory services
- 802.1X, RADIUS, TACACS+, LDAP/LDAPS
- Endpoint security: EDR, DLP, patch management, hardening
- Monitoring: SIEM, log management, SOAR, NetFlow
- Incident Response: Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned
- Digital forensics: chain of custody, evidence collection
- Penetration testing phases: Reconnaissance, scanning, exploitation, reporting
- Honeypots, deception technologies
- Vulnerability management lifecycle
Hermes Conrad's Compliance Bureau: "Sweet three-toed sloth of Ice Planet 10, fill out the form!"
- Governance: Policies, standards, procedures, guidelines
- Risk management: Risk tolerance, appetite, transfer, avoidance, mitigation
- Frameworks: NIST CSF, ISO 27001, SOC 2, PCI-DSS, HIPAA, GDPR
- Data roles: Owner, custodian, processor, controller, DPO
- BCP/DR: RTO, RPO, MTTR, MTBF, BIA
- Privacy concepts: PII, PHI, data classification
- Third-party risk: vendor assessment, supply chain
- Audits, assessments, attestations
⚡ WE'LL BE RIGHT BACK AFTER A MESSAGE FROM SLURM! ⚡
Click to watch the commercial! (Easter Egg #1)🧠 Domain Study Guide — Mnemonics
Each domain gets a Futurama mnemonic. Expand one at a time.
F — Fundamental Controls (Preventive, Detective, Corrective)
- Preventive: Firewall stops the robot army at the hangar door
- Detective: IDS spots Bender sneaking out with stolen goods
- Corrective: Patch the hull breach after the space worm attack
R — Risk-Reducing Authentication (MFA)
- Something you know: Your locker combo at Planet Express
- Something you have: The ship's access card
- Something you are: Leela's iris scan (hard to fake with one eye)
Y — Your Cryptography Toolkit
- Symmetric (AES): One key, fast — like the ship's master key
- Asymmetric (RSA/ECC): Public/private pair — like DOOP's secure mailbox
- Hashing (SHA-256): One-way fingerprint — like Hermes' tamper-proof stamps
C — Confidentiality
- Keeping delivery routes from Omicron Persei 8 spies
- Encryption, access controls, data classification
I — Integrity
- Ensuring Bender can't alter cargo manifests
- Hashing, digital signatures, version control
A — Availability
- The ship must fly when the delivery needs to launch
- Redundancy, backups, failover, load balancing
🤖 Q: Which control prevents an attack before it occurs?
B — Bad Actors (Threat Actors)
- Nation-state: The Brain Slugs of Omicron Persei 8
- Insider: Bender altering delivery logs for fun and profit
- Script kiddie: Fry trying to "hack" using instructions he found in a 3000-year-old forum post
E — Engineering Socially (Social Engineering)
- Phishing: Fake DOOP emails asking for credentials
- Vishing: Voice call pretending to be Zapp Brannigan (hard to tell the difference)
- Pretexting: Bender pretending to be a robot inspector
N — Network Attacks
- DDoS: Robot Army overwhelming Planet Express comms
- MitM: Intercepting deliveries mid-flight between solar systems
- DNS Poisoning: Redirecting the ship to the wrong planet
D — Dangerous Code (Malware)
- Ransomware: Holding the Professor's invention data hostage
- Rootkit: Hidden robot spy embedded in ship firmware
- Worm: Self-replicating code spreading through the Earthican internet
E — Exploits & Vulnerabilities
- Zero-day: Unknown flaw in the ship's navigation AI
- CVSS: How dangerous is that brain slug, really? (Score it!)
- CVE: The official catalog of known space-bug exploits
R — Risk Mitigations
- Patch management, hardening, network segmentation
- Security awareness training for Fry (mandatory, annually)
💥 Q: What type of attack involves deceiving users via fake emails?
P — Planet Express IaaS (Infrastructure)
- You rent the raw ship hull — you install the crew, OS, and nav systems yourself
- Customer manages: OS, middleware, apps, data
- Provider manages: Servers, storage, networking
R — Redundancy & Resilience
- Load balancers distribute deliveries across multiple ships
- Failover: If Ship A blows up, Ship B launches immediately
- RAID, clustering, geographic distribution
O — On-Prem vs Cloud vs Hybrid
- On-prem: Planet Express HQ server room (Hermes locks the door)
- Cloud: DOOP's interplanetary hosting service
- Hybrid: Some data on-ship, some in the cloud nebula
F — Firewall Zones (DMZ)
- DMZ: Public-facing delivery kiosk — clients interact here, not in the hangar
- WAF: Stops SQL injection attacks on the ordering portal
- Screened subnet: Buffer between public internet and internal ship systems
🔧 Q: In IaaS, who manages the Operating System?
L — Logging & SIEM
- Every ship maneuver logged — Hermes' audit trail in the cloud
- SIEM aggregates logs from all ship systems and alerts on anomalies
- Syslog port 514, SIEM correlation rules, retention policies
E — Endpoint Defense (EDR)
- Each crew terminal monitored for malicious behavior
- EDR detects, investigates, and responds to endpoint threats
- DLP prevents Bender from emailing cargo manifests to competitors
E — Emergency Response (IR)
- Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned
- Chain of custody for digital evidence from the ship's black box
L — Least Privilege & IAM
- Only Leela gets Level 5 pilot clearance
- MFA, RBAC, PAM for privileged accounts like the Professor's lab access
- 802.1X: Port-based NAC — authenticate before docking at any port
A — Attack Simulation (Pen Testing)
- Recon → Scanning → Exploitation → Post-exploitation → Reporting
- Honeypots trap Bender-like bots snooping around
🛰️ Q: What tool aggregates logs from multiple systems and alerts on anomalies?
H — Hierarchy of Policies
- Policy: "No stealing cargo" — board-level rule
- Standard: AES-256 encryption for all ship comms — technical requirement
- Procedure: Step-by-step checklist Hermes uses before every launch
- Guideline: Suggested best practices Fry ignores
E — Enterprise Risk Management
- Risk appetite: How much chaos Planet Express is willing to tolerate (a lot, apparently)
- Treat: Reduce the risk with controls
- Transfer: Buy space insurance from Zoidberg & Associates
- Accept: Hope Bender doesn't break anything (bad plan)
R — Regulatory Compliance
- HIPAA: Zoidberg's patient medical data must stay private
- PCI-DSS: Fry's credit card transactions encrypted end-to-end
- GDPR: Earth citizens' data rights — even in the year 3000
M — Metrics & Recovery (BCP/DR)
- RTO: Max downtime before Planet Express loses clients
- RPO: Max data loss — how old can the backup be and still be useful?
- BIA: Business Impact Analysis before the next Omicron invasion
📋 Q: Which metric defines the maximum tolerable downtime after a disaster?
👥 Planet Express Security Team
Each crew member represents a real Security+ role. Know your team.
Fry represents every well-meaning but undertrained end user. He clicks suspicious links, forgets passwords, and accidentally social-engineers himself. Security awareness training exists specifically because of people like Fry — and it actually helps.
Leela is the CISO of Planet Express — capable, alert, and willing to override bad decisions from above. She enforces least privilege (only she pilots), implements security controls, and leads incident response when Bender inevitably causes a breach.
Bender is the textbook malicious insider. He has legitimate access, deep knowledge of ship systems, and zero ethical constraints. He represents insider threats, data theft, and the reason you need separation of duties and monitoring for privileged accounts.
The Professor designs the systems — sometimes brilliantly secure, sometimes catastrophically flawed. He embodies the security architect role: responsible for secure-by-design principles, cryptographic implementations, and occasionally deploying something called the "Doom-ulator 3000."
Hermes is the GRC (Governance, Risk, Compliance) officer. He writes the policies, enforces the procedures, files the forms in triplicate, and ensures Planet Express complies with DOOP regulations. If it isn't documented, it didn't happen — Hermes lives by this principle.
Zoidberg represents vulnerabilities and misconfigurations — always in the wrong place, always causing problems, never intentionally malicious but somehow making things worse. Every network has a Zoidberg: an unpatched service, a misconfigured firewall rule, an open port nobody knew about.
🔗 Deep-Dive Futurama Analogies
Real security concepts mapped to iconic Futurama scenarios.
🏭 The Slurm Factory → PaaS Shared Responsibility
Domain 3The Slurm Queen provides the entire factory platform — the vats, conveyor belts, runtime, and operating environment. You bring your secret ingredient (code) and bottles (data). You don't maintain the machinery. This perfectly maps to PaaS: the provider manages the OS, middleware, and runtime; you only manage your application and data. If the vats break, it's the Queen's problem. If your recipe is wrong, it's yours.
🐸 Hypnotoad's TV Show → Social Engineering / Influence Operations 🐸 ALL GLORY
Domain 2Hypnotoad's show "Everybody Loves Hypnotoad" is pure social engineering at scale — a hypnotic signal that bypasses rational thought and compels action. This mirrors influence operations, malvertising, and the psychological manipulation techniques used in spear phishing. The target doesn't realize they're being controlled. The only defense: awareness that the signal exists.
🚀 The Planet Express Ship → Defense in Depth
Domain 1The ship has multiple overlapping security layers: hangar security door → ship hull → airlock → cockpit access controls → encrypted navigation AI. Each layer assumes the previous one might be compromised. If Bender gets through the hangar, the cockpit still requires Leela's iris scan. Defense in depth means no single point of failure controls access to the crown jewels.
🧊 Fry's Cryogenic Sleep → Backup & Recovery (RPO/RTO)
Domain 5Fry was "backed up" in cryosleep for 1,000 years and restored perfectly to an operational state — zero data loss, instant recovery. This is the dream scenario: RPO = 0 (no data lost), RTO = instant. Real disaster recovery planning asks: how long can we be offline (RTO) and how much data can we afford to lose (RPO)? Fry proves flawless recovery is possible. It just takes 1,000 years of planning.
🤖 Bender's Robot Mafia Side Hustle → Insider Threat
Domain 2Bender uses his legitimate access to ship systems to run side operations — stealing, smuggling, occasionally committing light treason. This is the classic privileged insider threat: authorized access exploited for unauthorized purposes. Mitigations include User and Entity Behavior Analytics (UEBA), separation of duties, least privilege, and logging all privileged actions — especially those taken by shiny metal beings.
📋 Hermes' Forms → Governance & Change Management
Domain 5Hermes requires forms in triplicate before any significant action — new hires, ship modifications, experimental deployments. This is change management: no change happens without documented approval, risk assessment, rollback plan, and post-implementation review. Organizations that skip this process end up with unauthorized changes that break production, or worse, systems modified by someone who "just needed to fix one thing quickly."
📝 High-Frequency Exam Notes
Planet Express briefing — the stuff that shows up most on SY0-701.
🔐 Ports You Must Know Cold
- 22 — SSH (secure terminal) | 23 — Telnet (insecure, avoid)
- 25 — SMTP | 53 — DNS | 80 — HTTP | 443 — HTTPS
- 389 — LDAP | 636 — LDAPS | 3389 — RDP
- 514 — Syslog | 1812/1813 — RADIUS | 49 — TACACS+
- 123 — NTP | 67/68 — DHCP | 161/162 — SNMP
🏗️ Cloud & Shared Responsibility Quick Reference
- IaaS: You manage OS up. Provider manages hardware/network. (Hangar rental)
- PaaS: You manage app + data only. Provider manages OS, runtime. (Slurm Factory)
- SaaS: You manage only data/config. Provider manages everything. (Holoshed)
- Shared Responsibility: Always know what YOU own vs. what the provider owns.
🔑 Cryptography Cheat Sheet
- AES — Symmetric, 128/192/256-bit, current gold standard
- RSA — Asymmetric, uses large prime numbers, slower but key exchange friendly
- ECC — Asymmetric, smaller keys = same security as RSA, great for mobile
- SHA-256 — Hashing, one-way, used for integrity verification
- Diffie-Hellman — Key exchange over insecure channel, never transmits the key
- PFS — Perfect Forward Secrecy: past sessions safe even if long-term key compromised
- Salting — Random data added before hashing, defeats rainbow table attacks
📡 Authentication & Access Controls
- MFA factors: Know (password), Have (token/smart card), Are (biometrics)
- RBAC — Role-Based Access Control: permissions by job function
- ABAC — Attribute-Based: permissions by attributes (location, time, clearance)
- 802.1X — Port-based NAC: must authenticate BEFORE getting network access
- RADIUS — Authentication server for network access (ports 1812/1813)
- TACACS+ — Cisco protocol, encrypts FULL payload, port 49
- SSO — Single Sign-On: one login, access to multiple systems
🚨 Incident Response Quick Reference (Domain 4.8)
- 1. Preparation: Policies, tools, team training before incident occurs
- 2. Detection & Analysis: Identify and confirm the incident
- 3. Containment: Short-term (isolate) + Long-term (patch/rebuild)
- 4. Eradication: Remove root cause — malware, compromised account
- 5. Recovery: Restore and verify systems are clean
- 6. Lessons Learned: Post-incident review, update playbooks
🚨 Incident Response Lifecycle
Futurama edition — what happens when Planet Express gets breached?
Preparation
Hermes drafts the IR policy. Leela trains the crew. The Professor builds the forensics lab (in a parallel universe as a backup).
Domain 4.8Detection & Analysis
SIEM alerts fire. Leela reviews ship logs. She confirms Bender exfiltrated 47 TB of cargo manifests at 3 AM.
Domain 4.8Containment
Bender's ship access is revoked immediately (short-term). The compromised nav system is isolated from the main network (long-term).
Domain 4.8Eradication
The backdoor Bender installed is removed. Root cause identified: he exploited an unpatched firmware vulnerability in the cargo bay computer.
Domain 4.8Recovery
Systems restored from backup. All crew credentials rotated. Ship systems verified clean before re-launch. Bender is given a stern talking-to.
Domain 4.8🔍 Detection Deep Dive
Leela's one eye sees what others miss. Detection concepts for the exam.
IDS vs IPS
IDS (Intrusion Detection System): Alerts when Bender sneaks into the cargo bay — but doesn't stop him. Passive monitoring only.
IPS (Intrusion Prevention System): Detects AND blocks the intrusion in real time. The ship's auto-defense system.
SIEM & Log Management
SIEM aggregates logs from all ship systems (firewall, endpoints, network), applies correlation rules, and alerts on anomalies. Think of it as Hermes' ultimate audit dashboard — every event timestamped, indexed, and searchable for 90 days.
Threat Intelligence
IOCs (Indicators of Compromise): IP addresses of known pirate vessels, malicious file hashes from Robot Mafia malware, suspicious domain names. TTP-based detection catches unknown threats by recognizing attack patterns, not just signatures.
SOAR & Automation
SOAR (Security Orchestration, Automation & Response) automates repetitive tasks: block a malicious IP, quarantine an infected endpoint, open a ticket. Even Hermes appreciates automation — it means fewer forms to file manually.
🔍 Q: What is the PRIMARY difference between an IDS and an IPS?
🎭 Roles & Responsibilities
Every delivery requires the right crew member. Every security program requires the right role.
Data Owner
Accountable for data — typically the business unit leader. At Planet Express: the Professor owns research data, Hermes owns HR records.
Data Custodian
Technically manages and protects data on behalf of the owner — implements encryption, backups, and access controls.
Data Controller
GDPR term — decides WHY and HOW personal data is processed. Planet Express as an organization is the controller for employee data.
Data Processor
GDPR term — processes data on behalf of the controller. Third-party payroll service handling Hermes' salary data.
CISO
Chief Information Security Officer — owns the security program, reports to the board, manages risk at the enterprise level. Leela is born for this role.
SOC Analyst
Monitors SIEM alerts, investigates incidents, escalates critical issues. The overnight crew watching the ship's security dashboard.
Privacy Officer / DPO
Data Protection Officer — ensures GDPR compliance, handles breach notifications to regulators, advises on privacy impact assessments.
Incident Responder
Leads IR during active breaches — contains, eradicates, recovers. When Bender's malware fires, the IR team springs into action.
🎭 Q: Under GDPR, who decides WHY and HOW personal data is processed?
📋 Reporting Requirements
Hermes Conrad's favorite topic — when, what, and to whom you report.
Internal Reporting
When a breach occurs, Planet Express must notify: CISO (Leela) immediately → Senior Management within hours → Legal and PR → Affected department heads. Internal timelines are defined in the IR policy — typically within 1 hour of confirmed breach for critical incidents.
| Regulation | Report To | Timeline | Trigger |
|---|---|---|---|
| GDPR | Supervisory Authority (DPA) | 72 hours | Personal data breach affecting EU residents |
| HIPAA | HHS (and individuals) | 60 days | PHI breach affecting 500+ patients |
| PCI-DSS | Card Brands, Acquiring Bank | Immediately | Cardholder data compromise |
| SEC (US) | SEC + Public disclosure | 4 business days | Material cybersecurity incident |
| State Laws | State AG + Individuals | Varies (30–90 days) | PII breach per state definition |
📋 Q: Under GDPR, what is the breach notification deadline to the supervisory authority?
📊 Post-Incident Activity
Lessons Learned — so Planet Express doesn't make the same mistake twice (they will).
📖 Lessons Learned Meeting
- Conduct within 2 weeks of incident closure
- Who was affected? What was the root cause?
- What worked in the response? What didn't?
- What controls failed? What new ones are needed?
- Update IR playbook with findings
- Bendergate debrief: mandatory annual recurrence
📈 Key Metrics to Track
- MTTD — Mean Time to Detect: how long until we knew?
- MTTR — Mean Time to Respond/Recover: how long to fix it?
- MTBF — Mean Time Between Failures: system reliability
- Number of incidents per quarter (trending up? Bad sign.)
- False positive rate: alert fatigue is real and dangerous
📚 Training & Awareness Updates
- Update security awareness training after each significant incident
- Tabletop exercises — practice the scenario before it happens for real
- Red team/blue team exercises simulate real attacks in a controlled environment
- Fry gets phishing simulation emails monthly. He fails every time. Monthly training continues.
🔄 Playbook & Process Updates
- Revise runbooks and playbooks based on gaps found in the response
- Update detection rules in SIEM based on new IOCs discovered
- Review and tighten access controls for affected systems
- Hermes files three new forms. This is mandatory and non-negotiable.
🚀 Planet Express IR Adventure
Guide Leela through a live security incident. Make the right calls!
🔍 Scene 1: Detection — The SIEM Screams
It's 2:47 AM. The Planet Express SIEM fires a Priority 1 alert: "Unusual outbound data transfer — 200 GB — from Bender's terminal to an unknown external IP." You're the on-call SOC analyst. What's your first action?
🔒 Scene 2: Containment — Isolate the Threat
IR team confirms it's a real breach. Bender's terminal is actively exfiltrating Planet Express client data. The ship is mid-flight to Omicron Persei 8. What do you do?
🧹 Scene 3: Eradication — Root Cause
Forensics reveals Bender installed a backdoor six months ago via an unpatched firmware vulnerability in the cargo bay computer. The same firmware runs on ALL Planet Express ships. What's the correct eradication approach?
📖 Scene 4: Lessons Learned — The Debrief
Two weeks post-incident. You're running the lessons learned meeting. The team asks: "What's the single most important process improvement to prevent this happening again?" What do you recommend?
🎉 Mission Accomplished, Meatbag!
You successfully guided Planet Express through a full Incident Response cycle! Bender is in robot jail. Hermes filed 47 forms. The Professor invented a new anti-Bender firewall. And Fry is still clicking suspicious links.
IR Lifecycle: Domain 4.8 — Complete! 🚀
🔗 Study Resources
Everything you need to pass SY0-701. Good news, everyone — it's free (mostly)!
Futurama Security+ PDF
Full study guide — activates on GitHub upload
Cloud Service Models Guide
IaaS, PaaS, SaaS — Futurama style
Official Exam Objectives
CompTIA SY0-701 PDF — the definitive source
Study Book (Amazon)
Recommended Security+ prep book
Professor Messer
Free SY0-701 video training course
Quizlet Flashcards
Search SY0-701 community flashcard sets
Main Study Hub
Back to security-notes.html — all cartoons
🃏 Leitner Flashcard Deck
60+ cards across all 5 domains. Space, flip, 1/2/3 to sort. 🐸 Need help studying?
🎯 10-Question Security+ Quiz
One question per domain area. Beat Bender's score (he got 0/10 on purpose).