Crestron Flex UC-ENGINE

Security Reference Guide

Crestron Electronics, Inc.

Original Instructions

The U.S. English version of this document is the original instructions.

All other languages are a translation of the original instructions.

Crestron product development software is licensed to Crestron dealers and Crestron Service Providers (CSPs) under a

limited nonexclusive, nontransferable Software Development Tools License Agreement. Crestron product operating

system software is licensed to Crestron dealers, CSPs, and end-users under a separate End-User License Agreement.

Crestron Electronics, Inc. in the United States and/or other countries. Intel is either a trademark or registered trademark

of Intel Corporation in the United States and/or other countries. Azure, Microsoft, Microsoft Intune, Microsoft Teams,

Office 365, Skype, and Windows are either trademarks or registered trademarks of Microsoft Corporation in the United

States and/or other countries. USB Type-C is either a trademark or registered trademark of USB Implementers Forum,

Inc. in the United States and/or other countries. Miracast and Wi-Fi are either trademarks or registered trademarks of

Wi-Fi Alliance. Zoom Rooms is either a trademark or registered trademark of Zoom Video Communications, Inc. in the

United States and/or other countries. Other trademarks, registered trademarks, and trade names may be used in this

document to refer to either the entities claiming the marks and names or their products. Crestron disclaims any

proprietary interest in the marks and names of others. Crestron is not responsible for errors in typography or

photography.

Product Software - Security Features 2

User Authentication 2

Audit Logging 2

Connectivity 2

Software Updates &Patches 2

Operating System 3

Antivirus and Anti-Malware 3

Network Configuration 3

Third-Party Software 4

Microsoft Teams Rooms 4

Network Port List 9

VLAN 11

Security Controls 12

Malware and Vulnerability Protection 12

Security Applications 12

Vulnerability Protection 12

Remote Connectivity 12

Role-Based Access Control 12

Password Security 12

Data Segregation 13

Security Reference Guide — Doc. 8726A Contents • i

ii • Contents Security Reference Guide — Doc. 8726A

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 1

This guide serves as a security reference and provides best practices for deploying all

variants of Crestron's UC-ENGINE, a powerful Intel® NUC Mini PC sold exclusively as part

of a complete Crestron Flex UC system and designed for use in a Microsoft Teams® or

Zoom Rooms™ software environment. The following information applies to the

UC-ENGINE, UC-ENGINE-Z, UC-ENGINE-SD, and UC-ENGINE-SD-Z models.

The UC-ENGINE is at the core of a complete Crestron Flex system, providing extreme

processing performance, Gigabit Ethernet, and complete connectivity for one or two HD

displays, USB cameras, and one USB audio conferencing device. It is designed as an

For general security policies, see the Crestron security web page.

2 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

System Specifications

For general product specifications, see the UC-ENGINE product page.

The following security features are supported:

User Authentication

When using a Microsoft Teams enabled device, two accounts are set up by default:a

Skype® account and a default Admin account for administrating the UC-ENGINE.

When using a Zoom Rooms enabled device, two accounts are setup as default: a CrestUC

account and a default Admin account for administrating the UC-Engine.

The UC-ENGINE supports connectivity to Microsoft Teams or Zoom Meeting services and

can utilize the following management portals:

Software Updates &Patches

Software updates are managed automatically through Windows Update. The UC-ENGINE

can be updated through MOST network domain management systems. For best practices

in using and managing Windows Update, see the Manage Windows Updates document.

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 3

Firewall enabled by default. Configuration of the operating system is required (see

"Network Configuration" below).

Standard Windows 10 services including Windows Defender and Windows Firewall are

enabled by default and are updated automatically.

Network Configuration

4 • Crestron Flex UC-ENGINE Security Reference Guide — Doc. 8726A

detailed in the EULA included with the device. The UC-ENGINE is shipped with either a

Microsoft Teams Rooms system or a Zoom Rooms system. Each of these applications are

interface on the UC-ENGINE.

All updates to the Microsoft Teams Rooms application, including security and feature

updates, are automatically installed by the Windows Store. All security and feature

updates are delivered in this manner. Users may not manually install updates to the

Microsoft Teams Rooms application. Configuration of the Microsoft Teams Rooms

application is done by selecting the “Settings” option under the “More” button on the main

interface screen.

For information on the configuration options available, see the Microsoft Teams Rooms

Deployment Guide.

Zoom Rooms

for room systems. The application is pre-installed as part of the device image created by

All updates to the Zoom Rooms application are either manually or automatically applied by

Security Reference Guide — Doc. 8726A Crestron Flex UC-ENGINE • 5

Network Infrastructure

The following diagrams show the network infrastructure in various configurations for the

C. Represents a flow initiated by a user on the customer network to Office 365/Teams