ion security is, in turn, to support information technology applications such as video communication. Security cannot be SO onerous that it impractically impedes business. Moreover, it cannot drain any more resources than necessary from investments that lead to revenue-generation. That said, video communications (especially Internet-oriented ones) introduce risks. Since the only alternative to taking risks is quitting business, one must formulate policy by classifying information assets and actions by value and by risk. Risk is fundamentally a product of asset value, asset vulnerability (how easy it is to compromise it), and the threats that might exploit those vulnerabilities. Threats and vulnerabilities must be viewed in terms of confidentiality, integrity, and availability. In a videoconference in which doctors are discussing a patient's medical history, confidentiality may be the top priority. A buy or sell order from a stockbroker might score highest in integrity (note that the three are not mutually exclusive; they just change priority). A videoconference with a potential employee who presently works for a competitor may require more confidentiality than a weekly company-wide report from the company president. The Information Security Officer is responsible Information Security and Video Communications to work with data owners to establish values and to identify risks (including those that result from regulatory obligations). With information asset classifications established, the ISO may prepare a high-level business impact analysis. This analysis should quantify the cost to the organization of the loss of each information asset. It should also compare and contrast how that loss relates to risks in confidentiality, integrity, and availability. However, determining the organization's plans for protecting its assets requires a guidelines and corporate information security policy that should include specific information security policies. Physical Security Physical security may be the least glamorous aspect o