CSO ("the magazine for the chief security officer") has a terrific, and well-balanced, article on the difficulty, and necessity, of patch management. I highly recommend it.