Encrypted remote login and command execution, and the transport under SFTP and SCP. The standard way to administer a Linux or BSD server.
Strong when configured properly and a liability when not. Disable password authentication in favour of keys, disable direct root login, and expect continuous automated login attempts the moment it is reachable from the internet.
Worth knowing. Moving SSH to a non-standard port stops the noise in your logs but is not security in itself — a real attacker scans all ports anyway.
Open 22 is normal and expected on a server. What matters is what sits behind it. Confirm password authentication is off, root login is off, and that fail2ban or equivalent is running. If you did not intend it to be public, restrict it by source address.
The port scanner will tell you whether 22 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.