Step-by-Step Guide to Deploying Push email with MSFP enabled WM5 Devices - while working with existing Firewalls like Checkpoint, etc. is a great post by Dave, where he makes some security considerations about deploying push email:
"So this is what I've come up with so far, and I hope it's useful for others. Essentially what I have done is talk this through with Jason Langridge as to the most secure method of deploying the push email while trying to work within what is going to be the typical constraints of a production environment - if you have any questions please drop me a line."
Definitely a must read!