Real Security or Obscurity?

About this interactive

Besides the server and the application, the communication between client and server needs protecting. One way is a VPN, most often IPsec, that encrypts and tunnels the traffic. The other is TLS at the application level. HTTP, FTP, SMTP and IMAP all send in clear text; with TLS over the top they become HTTPS, FTPS and the TLS versions of SMTP and IMAP. Cryptography ages, too, so old SSL and TLS versions should be turned off in favour of current ones. Port selection is a different kind of measure. Moving a service from its standard port, SSH from 22 for example, means fewer attackers bother, because they are after easy targets, and in the lesson's story the attempts dropped sharply. But a scan still finds the port and sees the service, and nothing about how the data is sent has changed. That is security through obscurity: sometimes useful for cutting noise, never relied on as security.

What you'll learn

Decide whether a change secures communication with a service (a secure protocol version, a current TLS version, a VPN) or only hides it (a non-standard port, an obscure path)
Explain why a non-standard port is security through obscurity: it can cut attempts, but it is not relied on as security

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

Key terms

Transport Layer Security: A cryptographic protocol that provides secure communication over a network, successor to SSL.
Security Through Obscurity: A security approach that relies on concealing system details, such as using non-standard ports, to reduce attack likelihood; not considered a reliable security control on its own.
Port: A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
IPsec: A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
Virtual Private Network: A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →