Crestron is a name most people have encountered without noticing: the touch panel on the boardroom table, the keypad in a luxury home, the system running a university's classrooms. All of it lives on the network, and a control system that can turn on every display in a building is, to an IT department, simply another networked device that has to be trusted. We are an authorized Crestron dealer and sit on Crestron's dealer council and beta program, so we field this question often. Here is what Crestron's security actually consists of, and what we do with it on a job.
What Crestron builds in
Crestron publishes its security posture, and the current generation of its products is built around the same standards an IT team applies to any server or switch:
- Encrypted communication. AES encryption for data, TLS and HTTPS for management and web interfaces, SSH for console access, and a secure version of Crestron's own control protocol between processors and devices.
- Network authentication. Support for 802.1X, so a Crestron device must prove its identity before the switch lets it onto the network, and PKI certificate authentication for device-to-device trust.
- Enterprise identity. Active Directory integration, so administrators log in with the same corporate credentials and policies as everywhere else, rather than a shared password written on a sticky note.
- Government-grade validation. Crestron products have been approved by the U.S. Department of Defense's Joint Interoperability Test Command and placed on the DISA Unified Capabilities Approved Products List, and Crestron offers products certified under the NIAP Common Criteria program. Those approvals exist because government customers require independent testing, and every other customer benefits from the same engineering.
- A published deployment standard. Crestron's Secure Deployment Guidelines document how to configure its products for a hardened environment, from changing default credentials to disabling unused services.
- Disclosure and updates. Crestron maintains a vulnerability reporting process and publishes security advisories, and its cloud management platform, XiO Cloud, has a public trust center describing its controls and compliance frameworks.
The specifics change as Crestron releases new products and firmware. The facts above come from Crestron's published security and trust pages, which are the right place to check the current state; we review them as part of every commercial design.
What we do with it
A secure product is only secure once it is installed that way. On our projects the control system is treated as IT equipment from the first design meeting:
- We follow Crestron's deployment guidelines: every default credential is replaced, authentication is enforced, and services the room does not need are turned off.
- Control and AV devices are placed on their own network segment, with the client's IT team defining what is allowed to cross into the corporate network.
- Where the organization uses 802.1X and Active Directory, the Crestron system joins those, so the AV system is governed by the same policies as the laptops.
- Firmware is kept current through XiO Cloud, which also gives the client and our team a single place to see the status of every device.
- Remote support runs through those managed channels, never through ports opened on the firewall, for the reasons in our note on port forwarding vs. VPN.
- For clients on our Smart Care plan, the system is monitored from our office, so a device that drops offline or falls behind on updates is a ticket, not a discovery.
What it means for a home
Residential clients rarely have an IT department, and that is exactly why the same discipline matters. A Crestron Home system installed to the deployment guidelines, on a properly segmented network, with remote access through the manufacturer's service, is far better protected than the collection of consumer gadgets it usually replaces. The rules are the same; the only difference is that we apply them for you.
If your IT team has a security questionnaire, we have answered many of them, and we would rather see it before the design than after the installation. Our AV control systems page covers the platforms we build on, and you can reach us here.