> Adding obscurity to your existing security stack / layers improves your security. In theory yes. In practice you are increasing the chance of someone else th

> Adding obscurity to your existing security stack / layers improves your security. In theory yes. In practice you are increasing the chance of someone else thinking "Oh this is secure I don't need to do that". I saw this very recently in several broadcasters all over the world - they have a broadcast server which comes with a well known default admin password for the webserver on port 80. Several of these blocked port 80 externally, but allowed another port (7071), as it said to do so in the manual. They then didn't bother changing the password because "port 80 is blocked". Had port 80 not been blocked they would have been more likely to think "Ooh I must change the password". Now it's not good they didn't change it anyway, but your flat statement that "Adding obscurity to your existing security stack / layers improves your security" only applies if nothing else in your security stack changes. I check port 22 on my public IP addresses to ensure that any servers are uptodate. Occasionally I'll find an out of date and yell at the department to fix it. That's far better than blocking port 22, as they then listen on port 2222 or similar, and never update their ssh servers, and then when someone does stumble across it, nobody has a clue it's happened. Never underestimate the ability for people to work around your "improved security" by introducing worse security problems