Crestron UC-ENGINE User guide

Brand: Crestron

Model: UC-ENGINE

Type: User guide

Crestron Flex UC-ENGINE

Security Reference Guide

Crestron Electronics, Inc.

Original Instructions

The U.S. English version of this document is the original instructions.

All other languages are a translation of the original instructions.

Crestron product development software is licensed to Crestron dealers and Crestron Service Providers (CSPs) under a

limited nonexclusive, nontransferable Software Development Tools License Agreement. Crestron product operating

system software is licensed to Crestron dealers, CSPs, and end-users under a separate End-User License Agreement.

Both of these Agreements can be found on the Crestron website at www.crestron.com/legal/software_license_

agreement.

The product warranty can be found at www.crestron.com/warranty.

The specific patents that cover Crestron products are listed at www.crestron.com/legal/patents.

Certain Crestron products contain open source software. For specific information, visit www.crestron.com/opensource.

Crestron, the Crestron logo, Crestron Fusion, and Crestron XiOCloud are either trademarks or registered trademarks of

Crestron Electronics, Inc. in the United States and/or other countries. Intel is either a trademark or registered trademark

of Intel Corporation in the United States and/or other countries. Azure, Microsoft, Microsoft Intune, Microsoft Teams,

Office 365, Skype, and Windows are either trademarks or registered trademarks of Microsoft Corporation in the United

States and/or other countries. USB Type-C is either a trademark or registered trademark of USB Implementers Forum,

Inc. in the United States and/or other countries. Miracast and Wi-Fi are either trademarks or registered trademarks of

Wi-Fi Alliance. Zoom Rooms is either a trademark or registered trademark of Zoom Video Communications, Inc. in the

United States and/or other countries. Other trademarks, registered trademarks, and trade names may be used in this

document to refer to either the entities claiming the marks and names or their products. Crestron disclaims any

proprietary interest in the marks and names of others. Crestron is not responsible for errors in typography or

photography.

Contents

Introduction 1

Intended Operational Environment 1

Security Policies 1

System Specifications 2

Product Software - Security Features 2

User Authentication 2

Audit Logging 2

Connectivity 2

Software Updates &Patches 2

Operating System 3

Antivirus and Anti-Malware 3

Network Configuration 3

Third-Party Software 4

Microsoft Teams Rooms 4

Zoom Rooms 4

Network Infrastructure 5

Hybrid Typology with Client Network 5

Hybrid Typology 6

Microsoft Teams to PSTNThrough Office 365 7

Microsoft Teams Meeting &Guest Network to PSTN 8

Network Port List 9

VLAN 11

Security Controls 12

Malware and Vulnerability Protection 12

Security Applications 12

Vulnerability Protection 12

Remote Connectivity 12

Role-Based Access Control 12

Password Security 12

Data Segregation 13

Cloud Storage 13

Physical Protection 13

Audit Logging 13

Data Protection 13

Security Best Practices 13

More Security Information 14

Security Reference Guide — Doc. 8726A Contents • i

ii • Contents Security Reference Guide — Doc. 8726A

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 1

Introduction

This guide serves as a security reference and provides best practices for deploying all

variants of Crestron's UC-ENGINE, a powerful Intel® NUC Mini PC sold exclusively as part

of a complete Crestron Flex UC system and designed for use in a Microsoft Teams® or

Zoom Rooms™ software environment. The following information applies to the

UC-ENGINE, UC-ENGINE-Z, UC-ENGINE-SD, and UC-ENGINE-SD-Z models.

Intended Operational Environment

The UC-ENGINE is at the core of a complete Crestron Flex system, providing extreme

processing performance, Gigabit Ethernet, and complete connectivity for one or two HD

displays, USB cameras, and one USB audio conferencing device. It is designed as an

appliance for meeting rooms to host video calls when connected to a Microsoft Teams or

Zoom Video Meeting service.

The UC-ENGINE comes preassembled on a bracket assembly as part of a Crestron Flex

kit. Other peripherals are to be provided by the user. For more information on Crestron

Flex kits, see the Crestron Flex web page.

Security Policies

For general security policies, see the Crestron security web page.

2 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

System Specifications

For general product specifications, see the UC-ENGINE product page.

Product Software - Security Features

The following security features are supported:

User Authentication

When using a Microsoft Teams enabled device, two accounts are set up by default:a

Skype® account and a default Admin account for administrating the UC-ENGINE.

When using a Zoom Rooms enabled device, two accounts are setup as default: a CrestUC

account and a default Admin account for administrating the UC-Engine.

The password for the default CrestUC or default Skype account MUST NOT be changed. If

changed, the device will require a factory reset.

Audit Logging

System tasks use Windows® standard audit logging. Security-related application tasks are

logged and stored in the audit log.

Connectivity

The UC-ENGINE supports connectivity to Microsoft Teams or Zoom Meeting services and

can utilize the following management portals:

l Crestron XiOCloud™

l Crestron Fusion®

l MicrosoftTeams Admin Center

l Zoom Admin Portal

l Microsoft Intune®

Software Updates &Patches

Software updates are managed automatically through Windows Update. The UC-ENGINE

can be updated through MOST network domain management systems. For best practices

in using and managing Windows Update, see the Manage Windows Updates document.

Future implementations will allow the management of updates through the Crestron XiO

Cloud software.

Optionally, Zoom devices may be managed through the Zoom web portal. For more

information, see the Zoom Help Center article.

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 3

Operating System

The UC-ENGINE uses the Windows 10 IoT Enterprise operating system with Windows

Firewall enabled by default. Configuration of the operating system is required (see

"Network Configuration" below).

NOTE: Do not force Windows build 1909 or 2004 to Microsoft Teams devices. For more

information on supported versions, visit the Microsoft documentation.

Antivirus and Anti-Malware

Standard Windows 10 services including Windows Defender and Windows Firewall are

enabled by default and are updated automatically.

Network Configuration

The UC-ENGINE is configured with the following settings. Additional action may be taken

where applicable.

l DHCP: Standard DHCPconfiguration

l Wi-Fi®: enabled in Windows, but not supported on the UC-ENGINE.

l Hardening: The Crestron Flex UC-ENGINE may be hardened like any other Windows

device under the condition that all Crestron services and ports are left active. Skype

for Business and Microsoft Teams must be left accessible.

l Unneeded Accounts: The built-in Admin account can be removed or disabled as long

as the device is domain attached. Doing so allows administrators to use any domain-

level admin account to log in.

l File Share: No file share is enabled by default.

l Unneeded Ports: Any ports besides those listed on the Network Port List (on page9)

may be disabled.

l Unneeded Services: All Crestron services must be left enabled. Any standard

Windows services can be disabled as needed.

l Unneeded Applications: All Crestron applications must be left enabled. Any standard

Windows applications can be disabled as needed.

l Restriction of External (USB)Devices: No restriction of external USBdevices.

Physical covers are initially placed over the USBplugs.

l Authentication of External Devices (e.g. USB Type-C® Authentication Specification):

No authentication.

l Customer Supplied Software (e.g. Printer Drivers): Any utility software can be

installed, but should be tested for interference with other software.

l Customer Supplied Anti-Malware: Windows Defender anti-malware is included and

enabled as a standard feature. Further anti-malware systems may be added, but

should be tested for system breakage or slowdowns.

4 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

Third-Party Software

All third-party and open source software and licenses used in Crestron applications are

detailed in the EULA included with the device. The UC-ENGINE is shipped with either a

Microsoft Teams Rooms system or a Zoom Rooms system. Each of these applications are

created and owned by Microsoft® or Zoom respectively.

Microsoft Teams Rooms

The Microsoft Teams Rooms app is a customized Microsoft Teams and Skype for Business

client created by Microsoft specifically for room systems. The application is pre-installed as

part of the device image created by Crestron and starts automatically as the main

interface on the UC-ENGINE.

All updates to the Microsoft Teams Rooms application, including security and feature

updates, are automatically installed by the Windows Store. All security and feature

updates are delivered in this manner. Users may not manually install updates to the

Microsoft Teams Rooms application. Configuration of the Microsoft Teams Rooms

application is done by selecting the “Settings” option under the “More” button on the main

interface screen.

For information on the configuration options available, see the Microsoft Teams Rooms

Deployment Guide.

Zoom Rooms

The Zoom Rooms app is a customized Zoom Meetings client created by Zoom specifically

for room systems. The application is pre-installed as part of the device image created by

Crestron and starts automatically as the main interface on the UC-ENGINE when it is in

Zoom mode.

All updates to the Zoom Rooms application are either manually or automatically applied by

the Zoom web portal. Users can download new versions of the Zoom Rooms application

installer from zoom.com and manually install them on the UC-ENGINE to upgrade the

Zoom software if desired.

For configuration instructions, see Zoom documentation.

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 5

Network Infrastructure

The following diagrams show the network infrastructure in various configurations for the

Microsoft Teams environment.

Hybrid Typology with Client Network

Signaling between Microsoft Teams and Skype for Business is bridged by a gateway in

Office 365®. However, media is routed directly peer-to-peer within the customer network

using flow E. Teams is deployed side by side with Skype for Business Online, hence clients

are displayed as "Teams/SFB user."

A. Represents a flow initiated by a remote mobile Microsoft Teams user with VPN to the

customer network.

C. Represents a flow initiated by a user on the customer network to Office 365/Teams

endpoints.

E. Represents a peer-to-peer media flow between a Microsoft Teams user and another

Microsoft Teams or Skype for Business user within the customer network.

6 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

Hybrid Typology

The direction of the arrows on the diagram above reflect the initiation direction of the

communication that affects connectivity at the enterprise perimeters. In the case of UDP

for media, the first packet(s) may flow in the reverse direction, but these packets may be

blocked until packets in the other direction will flow. Microsoft Teams is deployed side by

side with Skype for Business Online, hence clients are displayed as "Teams/SFB user."

A. Represents a flow initiated by a remote mobile Microsoft Teams user with VPN to the

customer network.

B. Represents a flow initiated by a remote mobileMicrosoft Teams user to Office

365/Teams endpoints.

C. Represents a flow initiated by a user on the customer network to Office 365/Teams

endpoints.

D. Represents a peer-to-peer media flow between a Microsoft Teams user within the

customer network and a Skype for Business on-premises media relay at the customer

network edge.

E. Represents a peer-to-peer media flow between a Microsoft Teams user and another

Microsoft Teams or Skype for Business user within the customer network.

F. Represents a peer-to-peer media flow between a remote mobile Teams user and

another remote mobile Teams or Skype for Business user over the Internet.

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 7

Microsoft Teams to PSTNThrough Office 365

The audio/video/screen sharing (VBSS) conferencing server is part of Office 365. It has a

public IP address that must be reachable from the customer network and a Nomadic

Cloud client. Each client/endpoint needs to be able to connect to the conferencing server.

Internal clients will obtain local, reflexive, and relay candidates in the same manner as

described for one-to-one calls. The clients will send these candidates to the conferencing

server in an invite. The conferencing server does not use a relay since it has a publicly

reachable IP address, so it responds with its local IP address candidate. The client and

conferencing server will check connectivity in the same manner described for one-to-one

calls.

A. Represents a flow initiated by a remote mobile Microsoft Teams user with VPN to the

customer network.

C. Represents a flow initiated by a user on the customer network to Office 365/Microsoft

Teams endpoints.

In this scenario, Teams clients cannot join Skype for Business meetings, and Skype for

Business clients cannot join Teams meetings. A PSTN user optionally "Dials IN" or is

"Dialed OUT", depending on the meeting's organizer PSTN Calling and/or conferencing

provisioning. A guest user or a customer user may join from a guest private network, which

is protected using FW/NAT with strict rules.

8 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

Microsoft Teams Meeting &Guest Network to PSTN