TUI Security (Windows CE 5.0)
The TUI application is designed to use a network. To mitigate potential security risks, use available network security resources.
Best Practices
Provide call privacy
The TUI displays caller information to show missed, incoming, and outgoing calls. OEMs can modify the application to hide the caller information for increased privacy for the use of IP phones in public places.
Be aware that applications might access private registry information
Applications that run on the phone might be able to access information that is private. Specifically, the TUI uses Windows CE Credential Manager functionality to store the user's plaintext credentials in RAM while the device is running.
If you use the Windows CE trust model, only trusted applications — those in ROM — can access the plaintext credentials. Untrusted applications not in ROM cannot access the plaintext credentials.
If you do not use the Windows CE trust model, all applications can access the plaintext credentials. Because of this, using the Windows CE trust model is even more important if you enable the ability to run additional applications or download software updates.
For more information about the Credential Manager, see Credential Manager.
Be aware that conference call participants are not automatically informed of all parties on a call
The call conferencing functionality provided by the TUI application enables more than two parties to participate in a single call. It does not provide any indication to participants that there might be more than two parties on the call.
Require a PIN to access network and user information on the phone
To protect network information and personal information from being inadvertently accessible on the phone, such as telephone numbers, speed dial lists, and Exchange information, provide or use a mechanism for locking types of information on the phone.
The default TUI implementation provides a PIN screen and integration with a Windows PC, as described in more detail in Limiting Access to Sensitive Information in the TUI.
Use authentication if you include a Web server on the phone
If you use the Web server for remote administration, use authentication. By default, be sure the phone requires administrator authentication. For more information, see Web Server Security.
Add a firewall to your internal network
To isolate internal packets from exposure to the Internet, you can add a network firewall. This also prevents random Internet traffic from entering your internal network. For more information, see IP Firewall.
Use a UUID instead of a MAC address for unique phone identification
MAC addresses can be discovered and spoofed, which could enable someone to intercept phone calls. Using a UUID instead of a MAC address can assure a truly unique identity for each device. For more information, see GUIDs and UUIDs.
Monitor the number of outstanding requests
If your client subscribes to presence information for multiple contacts, be sure the application processes events in a timely fashion. This prevents the number of outstanding events from becoming too large.
Default Registry Settings
Be aware of the registry settings that impact security.
If a value has security implications you will find a Security Note in the registry settings documentation.
For registry information, see TUI Registry Settings.
See Also
Telephony User Interface (TUI) | Enhancing the Security of a Device
Send Feedback on this topic to the authors