[r00f]

You never know which 0-day gets discovered tomorrow, so even strong password might not be enough. I always change default ports on both SSH and RDP. It helps falling out of scope of unsofisticatrd scanners, keeps logs a bit cleaner plus doesn't waste CPU on useless auth attempts. Keeping ports behind VPN or port knocking is even better, but not always feasible