We have a multi-user enterprise training application built using the Unity game engine and are discussing the security implications of adding a Windows Defender Firewall rule globally opening an application specific port for that application on the systems where it is run. Due to the architecture of the application the set of executable paths is not known at install time so we haven't figured out a better way to whitelist just the required port on just the executables we need than globally opening the required port.

The application is run under a non-admin account and is installed with an installer that doesn't currently require any elevated privileges. It doesn't do general disk IO, it only reads its own data files and writes out logs to hard coded locations. The systems the application runs on are not on the corporate domain and are not used for any other purpose (they should not have any sensitive data stored on them).

There is some concern about the security implications of globally opening a port. It seems to me that the real world risks are quite low. We can choose a port which is not used by any other applications or services running on the machine so the only real risk would be someone figuring out a successful remote privilege escalation attack on the application itself while it was running (a risk that is somewhat inherent to a multiplayer / multiuser game-type application). I may be missing some potential security implications here however. I'm interested to hear people's thoughts on how big a security issue this really is in practice.