Using non-standard ports for highly vulnerable applications is VERY GOOD practice. SSH has a lot of vulnerabilities and 22 is a common default port to brute force.

That being said, it probably depends. It's very common, especially in an enterprise environment, to see brute force attacks on DMZ servers against port 22. Many companies, in finance for instance, use a different default port for SSH/SFTP traffic for valid data transfer between organizations.

The idea in that case is more about filtering out some of the noise (Port 22 Brute Forcing) so the other traffic on an alternate port is easier to monitor. Anyone good enough can find any open port on an internet facing server.

This is considered a form of risk mitigation or risk reduction.

Edit: I should add: When I say good practice, I'm referring to good practice on your internet facing devices. Anything behind your firewalls is generally safe.

Using non-standard ports for application services is not good practice in terms of security.

The SSH service is a frequently targeted service and port 22 is a frequently scanned port.

Obscuring the SSH port by changing it may help protect you against broad stroke Internet scans, but a targeted scan will identify an alternative port in use.

Using non-standard ports for highly vulnerable applications is VERY GOOD practice. SSH has a lot of vulnerabilities and 22 is a common default port to brute force.

That being said, it probably depends. It's very common, especially in an enterprise environment, to see brute force attacks on DMZ servers against port 22. Many companies, in finance for instance, use a different default port for SSH/SFTP traffic for valid data transfer between organizations.

The idea in that case is more about filtering out some of the noise (Port 22 Brute Forcing) so the other traffic on an alternate port is easier to monitor. Anyone good enough can find any open port on an internet facing server.

This is considered a form of risk mitigation or risk reduction.

Using non-standard ports for highly vulnerable applications is VERY GOOD practice. SSH has a lot of vulnerabilities and 22 is a common default port to brute force.

That being said, it probably depends. It's very common, especially in an enterprise environment, to see brute force attacks on DMZ servers against port 22. Many companies, in finance for instance, use a different default port for SSH/SFTP traffic for valid data transfer between organizations.

The idea in that case is more about filtering out some of the noise (Port 22 Brute Forcing) so the other traffic on an alternate port is easier to monitor. Anyone good enough can find any open port on an internet facing server.

This is considered a form of risk mitigation or risk reduction.

Edit: I should add: When I say good practice, I'm referring to good practice on your internet facing devices. Anything behind your firewalls is generally safe.