% of the group had used the three previous steps to define overall security architecture. Finally, it found the group to have established processes to conduct quarterly reviews. Security should be engineered in, not bolted on as an afterthought. Therefore, when building a video communications infrastructure, it is important to know what security measures the manufacturer has built in, how difficult it may be to deploy them, and what conflicts and trade-offs may result. Do not accept the marketing shtick, talk to competitors and integrators and do your reading to learn the whole story. or, as we may say, see the whole picture. CONCLUSION There is no practical way to prevent security incidents, only to mitigate the risk. Moreover, it is possible (although increasingly unlikely) to take no precautions and be lucky. However, regulations and litigation can make getting compromised and being found to have not taken diligent precautions expensive. In its whitepaper, Security for Videoconferencing, Wainhouse Research warns, "PC-based videoconferencing systems are not considered ideal for secure videoconferencing Information Security and Video Communications applications." It continues, "Appliance based videoconferencing systems are better suited than PC-based systems for secure videoconferencing requirements." While such an assertion may be a helpful consideration, it is a typical example of a simplistic security recommendation. Security, like quality, is in the eye of the beholder. Security must be defined in terms of systems, requirements, risk, and risk tolerance. An information security posture is critical in protecting the confidentiality, integrity, and availability of an organization's information assets. With the migration of video communications to data networks, comes vulnerability to unauthorized data collection, storage, access, and processing. While eavesdropping is nothing new, the Internet has fostered more sophisticated and widespread means. An information security strategy should begin with a broad secur