Does implementing antivirus on your mail servers eliminate the need for AV on your hosts?

Absolutely not. Viruses can infect a host through other means: removable media, other Internet services, or local file system shares.

Before deploying AV for e-mail servers, what other action can provide at least as much benefit as network AV at a far lower cost?

User education. Explaining to users safe e-mail practices can significantly reduce the chance of a wide virus outbreakparticularly for zero-day viruses.

If you are providing DNS recommendations to a very small organization with only a small public web and e-mail presence hosted at its ISP, which DNS design from this chapter would you recommend?

If the company's services are hosted at its ISP and its user community is small, the company is better off hosting its DNS at a service provider rather than setting up a server locally. Its ISP probably provides recursive DNS servers, which can provide outbound resolution for the users.

When should you use HTTP as opposed to HTTPS? Does it impact the security design?

HTTPS is used instead of HTTP whenever secure communications are required. For many organizations, this is when financial or other sensitive transactions are involved. If you are just providing public information on the web, HTTPS is not necessary, but securing the web server is still required. For example, although Amazon.com sends inventory and pricing information to customers in the clear, it would be pretty unhappy if someone broke into its systems and changed the prices on some items to 1¢. HTTPS becomes a factor in security technologies that do some form of payload inspection. A firewall, for example, can't see what is going on inside the SSL connection, only that it is SSL. Network intrusion detection systems (NIDS) are in a similar situation. Some larger organizations are doing SSL offload on a network device on behalf of the servers. In this case, security technologies can be placed in the network path as long as they occur after the SSL decryption. See Chapter 11, "Supporting-Technology Design Considerations," for more information.