  In this paper, we question the common practice of assigning security impact
ratings to OS updates. Specifically, we present evidence that ranking updates
by their perceived security importance, in order to defer applying some
updates, exposes systems to significant risk.
  We argue that OS vendors and security groups should not focus on security
updates to the detriment of other updates, but should instead seek update
technologies that make it feasible to distribute updates for all disclosed OS
bugs in a timely manner.
