Cybersecurity Foundations (Grades 6–8) · lesson 16 of 48 · 12 min
The Language of Networks — Protocols and Ports
When two computers communicate, they need to agree on two things: how to communicate (the protocol) and which service to connect to (the port). Together, protocols and ports form the foundation of all network communication — and understanding them is essential for cybersecurity.
A protocol is a standardised set of rules that defines how data is formatted, transmitted, and received. Think of it like a language — both sides must speak the same protocol for communication to work. A port is a number that identifies which specific service on a computer should handle the incoming data. Think of it like an apartment number — the IP address gets you to the building, the port number gets you to the right door.
Why this matters for security
Every open port on a computer is a potential entry point for attackers. Port scanning is one of the first things attackers do when targeting a system — they use tools like Nmap to discover which ports are open and what services are running. Closing unnecessary ports and using encrypted protocols (HTTPS instead of HTTP, SSH instead of Telnet) dramatically reduces your attack surface.
The Essential Protocols
These are the protocols every cybersecurity student needs to know — what they do, which port they use, and whether they are secure.
Activity 1 — Protocol Matching
Protocol to Function Matching
Port Ranges and Security
There are 65,535 ports, divided into three ranges.
A firewall controls which ports are accessible from outside the network. A well-configured firewall blocks all ports by default and only opens the ones that are needed. This is called a default-deny policy — the most secure approach.
Port scanning is the technique attackers use to discover which ports are open on a target. Tools like Nmap send packets to each port and analyse the response. An open port means a service is listening — a potential entry point. Security professionals also use port scanning to audit their own systems and find unexpected open ports.
The most dangerous open ports
Port 3389 (RDP) exposed to the internet is one of the most common attack vectors for ransomware. Attackers scan the entire internet for open port 3389, then attempt brute-force attacks on the login. Thousands of ransomware attacks start this way. If you run a Windows server, never expose RDP directly to the internet — use a VPN instead. Port 23 (Telnet) should never be open — it sends everything including passwords in plain text.
Secure vs. Insecure Protocols
Many protocols have a secure and an insecure version. The insecure version sends data in plain text — anyone who can intercept the traffic can read it. The secure version encrypts the data so intercepted traffic is unreadable.
Activity 2 — Secure or Insecure?
Protocol Security Sorter
- HTTPS (port 443)
- secure
HTTPS uses TLS to encrypt all data between your browser and the web server.
- HTTP (port 80)
- insecure
HTTP sends all data in plain text — passwords, cookies, and form data can be intercepted.
- SSH (port 22)
- secure
SSH encrypts all communication — commands, data, and credentials are protected.
- Telnet (port 23)
- insecure
Telnet sends everything in plain text — including passwords. Never use it.
- SFTP (port 22)
- secure
SFTP uses SSH encryption for file transfers — data and credentials are protected.
- FTP (ports 20/21)
- insecure
FTP sends files and credentials in plain text. Use SFTP instead.
- IMAP over TLS (port 993)
- secure
IMAP on port 993 uses TLS encryption for email retrieval.
- Traditional DNS (port 53)
- insecure
Standard DNS queries are sent in plain text — your ISP can see every domain you look up.
Activity 3 — Port and Protocol Scenarios
Port and Protocol Security Decisions
Activity 4 — Flashcard Review
Ports and Protocols — Key Terms
Protocol A standardised set of rules defining how data is formatted, transmitted, and received. Both communicating parties must use the same protocol. Examples: HTTP, HTTPS, SSH, DNS, SMTP.
- Core
- Port
A number (0–65535) that identifies which specific service on a computer should handle incoming data. IP address = the building; port = the apartment number. Open ports are potential attack entry points.
- Core
- HTTPS (port 443)
HTTP with TLS encryption. The padlock in your browser. Encrypts all data between your browser and the web server. Always use HTTPS for passwords, payments, and sensitive information.
- Protocol
- SSH (port 22)
Secure Shell. Encrypted protocol for remote server access and secure file transfer (SFTP). Replaced Telnet. All commands and data are encrypted — credentials cannot be intercepted.
- Protocol
- Telnet (port 23)
Unencrypted remote access protocol. Sends all data including passwords in plain text. Never use — replaced by SSH. An open Telnet port is a critical security vulnerability.
- Protocol
- Port Scanning
A technique used to discover which ports are open on a target system. Tools like Nmap send packets to each port and analyse responses. Used by attackers to find entry points and by defenders to audit their own systems.
- Technique
- Default-Deny Firewall Policy
A firewall configuration that blocks all ports by default and only opens the ones that are explicitly needed. The most secure approach — reduces attack surface to the minimum necessary. Security
Activity 5 — Ports and Protocols Quiz
Ports and Protocols — Knowledge Check
A web server has ports 22 (SSH), 80 (HTTP), 443 (HTTPS), and 3389 (RDP) open to the internet. Which port represents the most critical security risk?
- Port 22 (SSH)
- Port 80 (HTTP)
- Port 443 (HTTPS)
- Port 3389 (RDP)
Answer: Port 3389 (RDP)
RDP (Remote Desktop Protocol) exposed to the internet is a critical vulnerability. It is one of the most commonly exploited entry points in ransomware attacks. RDP should never be directly exposed to the internet — use a VPN instead. SSH (port 22) is also risky if using password authentication, but RDP is the higher priority.
What is the difference between HTTP (port 80) and HTTPS (port 443)?
- HTTPS is faster than HTTP
- HTTPS encrypts data between your browser and the server; HTTP sends everything in plain text
- HTTP is for websites; HTTPS is for apps
- HTTPS requires a login; HTTP does not
Answer: HTTPS encrypts data between your browser and the server; HTTP sends everything in plain text
HTTP sends all data unencrypted — anyone on the network can read it, including passwords and form data. HTTPS uses TLS encryption to protect data in transit. Always use HTTPS for anything sensitive. The padlock in your browser indicates HTTPS is active.
Telnet (port 23) is a secure alternative to SSH for remote server management.
- True
- False
Answer: False
Telnet sends all data — including usernames and passwords — in plain text. Anyone who can intercept the network traffic can read your credentials. SSH (port 22) replaced Telnet by encrypting all communication. Telnet should never be used for remote management.
Try it: Common ports
Previous lesson: Routers, switches, and DNS
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: What is Linux?