The phone uses TLS encryption to protect the session back to the ASA if setup properly. There are some DoS vulnerabilities to PhoneProxy though as it is not really authenticating the device in any way other than to bring up the TLS proxy. The UCM node that the ASA is pointed to is somewhat exposed to the outside world because of this, esp if a phone is lost/stolen as every phone uses the same key.
Also, I believe the first release does not support encrypting the PC Port but please confirm the docs. When I saw this in alpha form in a class, it wasn't there and no one was saying it would be...
