What exactly is a service pack in Sitecore terminology? Is it same as Sitecore upgrade?
For any particular version of Sitecore, for ex, Siteocore 8.1 Update 1, where can I get the recommended service packs and security updates ?
Taking a look at the historical nomenclature of past releases, which you can find here, there has only been one release considered a Service Pack. (8.0 Update-7, Which was called a Service Pack.)
Sitecore considers Service Packs a feature upgrade that should be installed and upgraded to on all environments, including Production.
At it's root, a Service Pack (using 8.0U7 as an example) is the same thing as an Update with some added significance to feature availability or functionality.
Major version upgrades generally are not suggested unless new functionality is desired within a solution or when a major version of Sitecore is at end of life.
That said, many agencies and professionals agree that staying on a major version for too long can have serious implications when deciding to finally upgrade. An example of this is the jump from v7 to v9 is possible, but a lengthy process.
As Sitecore provides major upgrades (like 9 where infrastructure needs are heavily impacted), these upgrades should be methodically planned, and completely thoughtout. Seeking support from a Sitecore partner is suggested to ensure everything has been considered prior to upgrading.
These upgrades generally release new features within a major version, or provide a full roll-up of hotfixes from a previous minor version. Some minor version upgrades seem not so minor (like the jump from 8.1 to 8.2, or 7.2 to 7.5) and should be planned accordingly.
Updates within a minor version should always be considered as a job to be done during routine maintenance windows or when a problem presents itself that appears to be resolved by the update, or at the behest of Sitecore Support. Staying current on Updates is crucial.
Hotfixes are rarely published, but are routinely provided by Sitecore Support when new bugs or major issues are identified by clients in a Production scenario. Generally hotfixes are baked into the next release and only then published as release notes.
Security Bulletins are published on Sitecore's KnowkedgeBase site when security vulernabilities are made public to help with 0-Day security issues. There have only been a handful of these bulletins and generally the Sitecore Community at large does a fantastic job of communicating when these are announced.
These bulletins are usually added as part of the next Update released.
If it isn't clear, your Sitecore implementation should always be running the most current Update within your minor version of Sitecore (e.g. for 8.2, you should be on Update-6).
Outside of that, submitting a Sitecore Support ticket asking for applicable updates and hotfixes for your version of Sitecore, especially if you are having issues, is generally the best practice.