Service and port management in Cybersecurity - Step-by-Step Execution

Concept Flow - Service and port management

Start: Identify Services

↓

List Open Ports

↓

Match Ports to Services

↓

Decide Action

↓

Allow

↓

Update Firewall Rules

↓

End

This flow shows how to identify running services, find their open ports, decide how to manage them, and apply security actions.

Execution Sample

Cybersecurity

Service: SSH
Port: 22
Action: Allow

Service: FTP
Port: 21
Action: Block

This example shows checking two services and deciding to allow SSH on port 22 but block FTP on port 21.

Analysis Table

Step	Service	Port	Check Open?	Decision	Action Taken
1	SSH	22	Yes	Allow	Firewall rule added to allow port 22
2	FTP	21	Yes	Block	Firewall rule added to block port 21
3	HTTP	80	No	No action	No rule change
4	SMTP	25	Yes	Monitor	Logging enabled for port 25
5	-	-	-	-	Process complete

💡 All services checked; actions applied based on open ports and security policy.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Open Ports List	[]	[22]	[22, 21]	[22, 21]	[22, 21, 25]	[22, 21, 25]
Firewall Rules	{}	{Allow 22}	{Allow 22, Block 21}	{Allow 22, Block 21}	{Allow 22, Block 21}	{Allow 22, Block 21}
Monitoring	{}	{}	{}	{}	{Monitor 25}	{Monitor 25}

Key Insights - 3 Insights

Why do we block some ports but allow others?

We block ports for services that are risky or not needed, like FTP on port 21 here (see step 2 in execution_table), to reduce attack surface. We allow trusted services like SSH on port 22 (step 1).

What happens if a port is not open?

If a port is not open, no action is needed (step 3). This means no service is listening there, so no firewall rule changes are required.

Why monitor some ports instead of blocking or allowing?

Monitoring (step 4) is used when we want to watch traffic for suspicious activity without blocking it, often for services that are sensitive or under review.

Visual Quiz - 3 Questions

Look at the execution_table, what action is taken for the FTP service at step 2?

A Allow port 21

B Monitor port 21

C Block port 21

D No action

💡 Hint

Check the 'Decision' and 'Action Taken' columns for step 2 in the execution_table.

At which step does the process decide no action is needed because the port is closed?

A Step 1

B Step 3

C Step 4

D Step 5

💡 Hint

Look for the step where 'Check Open?' is 'No' in the execution_table.

If the SSH port 22 was closed, how would the firewall rules change after step 1?

A No change to firewall rules

B Add rule to allow port 22

C Add rule to block port 22

D Enable monitoring on port 22

💡 Hint

Refer to variable_tracker for Firewall Rules after step 1 and consider what happens if port is not open.

Concept Snapshot

Service and port management:
- Identify running services and their ports
- Check if ports are open
- Decide to allow, block, or monitor each port
- Apply firewall rules or monitoring accordingly
- Helps secure network by controlling access

Full Transcript

Service and port management involves identifying which services are running on a system and which ports they use. The process checks if these ports are open and then decides whether to allow traffic, block it, or monitor it for security reasons. For example, SSH on port 22 is often allowed for remote access, while FTP on port 21 may be blocked due to security risks. If a port is closed, no action is needed. Monitoring is used to watch traffic on sensitive ports without blocking it. This management helps protect the network by controlling which services can communicate through the firewall.

Practice

1. What is the main purpose of managing services and ports on a computer system?

easy

A. To control which services are accessible and improve security

B. To increase the speed of the internet connection

C. To install new software automatically

D. To backup all files on the system

Solution

1. Step 1: Understand service and port roles

   Services use ports to communicate over networks, so managing them controls access.

2. Step 2: Identify the security benefit

   Closing unused ports prevents unauthorized access, improving system security.

3. Final Answer:

   To control which services are accessible and improve security -> Option A

4. Quick Check:

   Service and port management = Control access [OK]

Hint: Managing ports controls access to services for security [OK]

Common Mistakes:

• Confusing port management with internet speed
• Thinking it installs software
• Assuming it backs up files

2. Which of the following is the correct way to specify a port number when configuring a service?

easy

A. Using letters instead of numbers

B. Using any number above 70000

C. Using negative numbers

D. Using a number between 0 and 65535

Solution

1. Step 1: Recall valid port number range

   Ports are numbered from 0 to 65535 according to networking standards.

2. Step 2: Eliminate invalid options

   Numbers above 65535, negative numbers, or letters are invalid for ports.

3. Final Answer:

   Using a number between 0 and 65535 -> Option D

4. Quick Check:

   Port numbers range 0-65535 [OK]

Hint: Ports must be 0-65535, no letters or negatives [OK]

Common Mistakes:

• Choosing numbers above 65535
• Using negative numbers
• Using letters as ports

3. Consider a server running a web service on port 80 and an SSH service on port 22. If the firewall blocks port 22 but allows port 80, what will happen?

medium

A. Users can access the web service but cannot connect via SSH

B. Users can connect via SSH but cannot access the web service

C. Both web and SSH services will be accessible

D. Neither web nor SSH services will be accessible

Solution

1. Step 1: Identify allowed and blocked ports

   Port 80 (web) is allowed; port 22 (SSH) is blocked by the firewall.

2. Step 2: Determine service accessibility

   Web service on port 80 will be accessible; SSH on port 22 will be blocked.

3. Final Answer:

   Users can access the web service but cannot connect via SSH -> Option A

4. Quick Check:

   Firewall blocks port 22, allows 80 = Web yes, SSH no [OK]

Hint: Blocked port means service on it is inaccessible [OK]

Common Mistakes:

• Assuming blocked port still allows access
• Confusing port numbers with services
• Thinking all services are blocked

4. A system administrator tries to start a service on port 21 but gets an error. The port is already in use by another service. What is the best way to fix this?

medium

A. Restart the computer without checking the port

B. Ignore the error and run both services on port 21

C. Change the new service to use a different free port

D. Uninstall the operating system

Solution

1. Step 1: Understand port conflict

   Two services cannot use the same port simultaneously; this causes errors.

2. Step 2: Choose a solution to avoid conflict

   Changing the new service to a free port resolves the conflict safely.

3. Final Answer:

   Change the new service to use a different free port -> Option C

4. Quick Check:

   Port conflict fixed by using different port [OK]

Hint: Use a free port to avoid conflicts [OK]

Common Mistakes:

• Restarting without fixing port conflict
• Trying to run two services on same port
• Taking extreme actions like uninstalling OS

5. You want to secure a server by closing all unused ports but keep services on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) open. Which approach is best?

hard

A. Disable all services including SSH, HTTP, and HTTPS

B. Configure the firewall to block all ports except 22, 80, and 443

C. Open all ports to avoid blocking any service

D. Only block port 80 and 443, keep others open

Solution

1. Step 1: Identify required open ports

   Services on ports 22, 80, and 443 must remain accessible for SSH and web traffic.

2. Step 2: Apply firewall rules to block unused ports

   Blocking all other ports except these three limits exposure and secures the server.

3. Final Answer:

   Configure the firewall to block all ports except 22, 80, and 443 -> Option B

4. Quick Check:

   Block unused ports, keep needed open = Secure server [OK]

Hint: Block all except needed ports for best security [OK]

Common Mistakes:

• Disabling needed services
• Opening all ports reduces security
• Blocking needed ports breaks services