it all depends... if it's a shared hosting solution, i'd assume so.. dunno what 1and1 is offering for him..

sometimes dedicated server packages just leave security up to the client or they charge for a 'managed hosting' kinda dealio to do that..