How do you handle VNC across an untrusted network?

VNC over an untrusted path is a question people answer very differently depending on what they are
allowed to install and who signs off on it.

If you tunnel, what do you tunnel over, and what does that cost you in setup time when a colleague
has to reproduce it? If you do not tunnel, what compensating controls are you relying on?

Please describe what you actually run rather than what you would run in an ideal environment. The
gap between those two is the interesting part.