Raising the cost of attacks is a good thing, particularly if the cost of doing so is not too great. However, beware that obscurity is in the eye of the beholde

Raising the cost of attacks is a good thing, particularly if the cost of doing so is not too great. However, beware that obscurity is in the eye of the beholder, or more relevantly, in the eye of the attacker. For example, script kiddie attackers may be the ones who in the twitter example only scan the default ports. This is an important element to defend against. But a seriously skilled attacker isn't going to use script kiddie methods. They will use more complete, likely stealthy attack patterns. Bear in mind that what you think of obscure may be breakfast for a skilled attacker. If you are serious about defense, then you will be compelled to follow the ninja threat model, which, in part, says The attacker is going to sit on the same network segment as the application. There’s no firewall or filters. There’s a special place in hell reserved for products that require firewalls or filtering to protect themselves against attack. Focus too much on obscurity and you will fall victim to the fallacy of "defense by presumed motive."