Maybe the test should be: "is my system considered to be secure even without any obscurity?" If the answer is yes, then add obscurity. For instance, the port 2

Maybe the test should be: "is my system considered to be secure even without any obscurity?" If the answer is yes, then add obscurity. For instance, the port 22 example. Suppose you have a bastion host. SSHD running on port 22, root password disabled, passwords disabled (only SSH keys), no other services running, all other ports filtered/closed. It should be fairly secure, even if exposed to the internet, right? Now you can change the port. Change the SSH banner and hide the version. Add some port knocking. And so on. None of these measures would work by itself, but they will discourage non-targeted attackers.