Part 1: The Attack Surface (Critical Ports & Architectural Rules)

Instead of a basic list, here are the most critical ports categorized by their architectural domain, along with the “Golden Rules” for securing them.

1. Identity & Infrastructure (The Crown Jewels)

These ports manage authentication, directory services, and remote administration. If an attacker compromises these, they own the environment.

• Port 22 (SSH – Secure Shell): Secure remote command-line access for Linux/Cloud instances.
  • Attack: Brute force, weak key exploitation.
  • Rule: Never expose to the public internet. Use bastion hosts, AWS Systems Manager Session Manager, or Azure Arc for secure, audited access.
• Port 389 / 636 (LDAP / LDAPS) & 88 (Kerberos): Active Directory and identity authentication.
  • Attack: LDAP injection, Kerberoasting, Pass-the-Hash.
  • Rule: Strictly segment Domain Controllers. Only allow authorized application servers to query LDAPS. Monitor for anomalous Kerberos ticket requests.
• Port 3389 (RDP – Remote Desktop Protocol): Remote GUI access for Windows.
  • Attack: Brute force, BlueKeep (RCE vulnerability), credential stuffing.
  • Rule: Absolutely never expose RDP to the internet. Enforce NLA (Network Level Authentication) and require MFA. Route RDP through a secure Zero Trust gateway or jump server.
• Port 445 (SMB – Server Message Block): Windows file sharing and internal RPC communication.
  • Attack: EternalBlue (WannaCry), lateral movement, Pass-the-Hash.
  • Rule: Block at the perimeter. Never allow Port 445 to cross security zones (e.g., from the DMZ to the internal network).

2. Web, Application & Data (The Fintech Engine)

These ports handle user-facing traffic and backend data storage.

• Port 80 / 443 (HTTP / HTTPS): Web traffic and APIs.
  • Attack: SQL Injection (SQLi), Cross-Site Scripting (XSS), DDoS, SSL stripping.
  • Rule: Redirect all Port 80 to 443. Terminate TLS at the WAF/Load Balancer. Enforce TLS 1.2/1.3.
• Port 53 (DNS – Domain Name System): Name resolution (UDP/TCP).
  • Attack: DNS Tunneling (data exfiltration), Amplification DDoS, Cache Poisoning.
  • Rule: Force all internal DNS queries through centralized, monitored resolvers. Block direct outbound Port 53 to the internet at the firewall.
• Ports 1433, 3306, 5432, 1521 (MSSQL, MySQL, PostgreSQL, Oracle): Database access.
  • Attack: SQL Injection, unauthorized access via misconfigured cloud Security Groups.
  • Rule: Never assign public IPs to databases. Place them in private subnets. Access should only be allowed from specific application server security groups, not by IP ranges.

3. OT / ICS (Tailored to your SCADA/PLC background)

Industrial protocols operate on specific ports and lack native encryption or authentication.

• Port 502 (Modbus TCP), 20000 (DNP3), 44818 (EtherNet/IP): Industrial control communications.
  • Attack: Unauthorized PLC logic changes, command injection, physical disruption.
  • Rule: Enforce the Purdue Model. Use Industrial DMZs (IdMZ) and specialized OT firewalls that understand these protocols to whitelist only valid commands (e.g., “Allow Read, Block Write”).

---

Part 2: Major Cyber Attacks Explained (By Vector)

Understanding the attacks allows you to map your security controls to the specific ports and layers they target.

1. Network & Transport Layer Attacks (Targeting L3/L4 & Ports)

• DDoS (Distributed Denial of Service): Overwhelming a target with traffic to halt availability.
  • Volumetric (L3/L4): UDP Amplification or TCP SYN Floods. They consume all bandwidth or firewall state tables. Mitigation: Upstream cloud scrubbing centers (AWS Shield, Cloudflare).
  • Application (L7): HTTP Floods targeting specific APIs or login pages. Mitigation: WAF rate-limiting and bot management.
• Man-in-the-Middle (MitM) & ARP Spoofing: Intercepting communication between two parties.
  • How it works: On a local LAN (L2), an attacker sends fake ARP messages, mapping their MAC address to the IP of the default gateway. All traffic flows through the attacker. Mitigation: 802.1X network access control, Dynamic ARP Inspection, and encrypting all traffic (mTLS/HTTPS).

2. Application & Identity Attacks (Targeting L7 & IAM)

• Injection Flaws (SQLi, NoSQLi, OS Command Injection):
  • How it works: The attacker inputs malicious code (e.g., ' OR 1=1 --) into a web form or API endpoint. The application mistakenly executes this code against the backend database (Port 1433/3306) or OS. Mitigation: Parameterized queries, input validation, and WAFs.
• Cross-Site Scripting (XSS) & Cross-Site Request Forgery (CSRF):
  • How it works: XSS injects malicious JavaScript into a trusted website, which then executes in the victim’s browser (stealing session cookies). CSRF tricks a logged-in user’s browser into executing an unwanted action (like transferring funds). Mitigation: Content Security Policy (CSP), secure coding, and anti-CSRF tokens.
• Credential Stuffing & Brute Force:
  • How it works: Automated bots test millions of stolen username/password combinations (Stuffing) or guess passwords (Brute Force) against login portals (Port 443). Mitigation: Enforce FIDO2 hardware MFA, implement account lockouts, and use CAPTCHA/rate limiting.

3. Post-Exploitation & Lateral Movement (Internal Network)

• Pass-the-Hash (PtH) & Kerberoasting:
  • How it works: Once inside, attackers dump memory (LSASS) to steal NTLM hashes or request Kerberos tickets. They then use these cryptographic tokens to authenticate to other servers (via Port 445/88) without needing the plaintext password. Mitigation: This is where your CyberArk/PAM expertise shines. Implement a tiered administration model, restrict local admin rights, and monitor for anomalous ticket requests.
• Ransomware & Wipers:
  • How it works: Malware spreads laterally (often via SMB/Port 445), identifies critical data or databases, and encrypts it using strong cryptography, demanding payment. Mitigation: Micro-segmentation to stop lateral movement, EDR to halt the encryption process, and immutable, offline backups.

4. Advanced & Emerging Attacks

• Supply Chain Attacks:
  • How it works: Instead of attacking your heavily defended Fintech platform directly, the attacker compromises a trusted third-party vendor (e.g., an IT monitoring tool like SolarWinds, or an open-source library). When your system updates the vendor software, the malware is pulled inside the perimeter. Mitigation: Software Bill of Materials (SBOM), strict egress filtering, and Zero Trust network segmentation.
• AI-Powered Social Engineering (Vishing/Phishing):
  • How it works: Attackers use Generative AI to clone a CEO’s voice (deepfake) to call a finance employee and authorize a wire transfer, or to create flawless, highly personalized phishing emails. Mitigation: Strict financial verification processes (out-of-band verification), and shifting trust from human verification to cryptographic identity (Zero Trust).

---

Part 3: The Security Leader’s Strategy (Managing the Attack Surface)

When interviewing for a Head of Platform Security role, you must demonstrate how you govern these ports and attacks at an enterprise scale. You do this through three strategic pillars:

1. Attack Surface Management (ASM):
   • The Strategy: “You cannot secure what you cannot see. I implement continuous, automated ASM to discover shadow IT, forgotten cloud instances, and exposed ports (like an accidentally public RDP or Database port). We continuously validate our external and internal attack surface from the perspective of an attacker.”
2. Zero Trust & Micro-segmentation:
   • The Strategy: “I enforce a ‘Default Deny’ posture. Just because Port 443 is open to the internet for our web tier, does not mean Port 5432 (PostgreSQL) is open to the web tier. I use micro-segmentation (AWS Security Groups, VMware NSX) to ensure that if an attacker breaches the web application, they are blocked from moving laterally to the database.”
3. Strict Egress Filtering:
   • The Strategy: “Most organizations focus entirely on ingress (keeping attackers out). I focus equally on egress (keeping data in and stopping C2). I block all outbound traffic at the perimeter by default. If malware executes on an endpoint, it cannot call home to the attacker’s server because the firewall drops the unauthorized outbound connection.”