Port numbers are convention

A "security engineer minded approach" would be: own what is executed on the box;