The need for "defense" implies an adversarial game with an opponent. I'm betting that the people who set up this security policy did it out of negligence rather

The need for "defense" implies an adversarial game with an opponent. I'm betting that the people who set up this security policy did it out of negligence rather than actively looking at port 22 and deciding not to allow it.