I have a computer with Debian installed setup very minimally to run a few tools and manage a database. The only time it needs to connect to the internet is for security updates.

Is it more secure to leave a computer disconnected, but never updated? Or are there sometimes security updates are useful even to a system that is not connected to the internet?

Any system that anyone accesses in any way may benefit from security updates as not all vulnerabilities "come from the internet". There are many security vulnerabilities that have "local" attack vectors.

You have to take a look at what the updates are and then decide if there are any mitigating factors. For an incredibly simplistic example, a security update for a specific apache vulnerability may be mitigated by the fact that you aren't running apache on that server.

1 members found this post helpful.

Some bugs which may corrupt valuable data may be thought as a security issue. And updating helps to fix such bugs. Again checking a update if it's actually needed is a basic protocol.

Disconnected.

Updated. There are plenty of local privilege escalation exploits that get fixed. As these can be exploited locally, staying updated is the best way to keep the system secure.

You are also assuming that a disconnected system is more secure than a connected system. Recent malware suggests otherwise. Although the malware is rare and highly targeted, it is a proof of concept that air-gapped machines are not safe from malware.

2 members found this post helpful.

Indeed updated for the reasons stated above. Even if you run the machine attached to a LAN that may still be considered a hostile environment (unless the only user is you and you trust yourself, heh). To filter out security updates (here: example CVE-2015-0239) it's always good to check your distros take on things (or Mitre.org or the NVD), the latter also provides CVSS metrics to help you determine if you must upgrade immediately (or not). *Also note these days systems aren't really static anymore: requirements, location and even the state of networks change more easily, so leaving out updates may bite you when you try to modify, move or migrate it.

Ok, there is one, single exception: if you never want/will connect it to any network, never plug in usb (or other) devices, never mounts any kind of removable media (like cd, dvd), never installs anything, just use as a standalone machine - or never switches it on.