LSASS is the Local Security Authority Subsystem. It's ultimately responsible for making the access granted / access denied decision when you attempt to access resources in a Windows NT-derived operating system. Each time you try to access any resource, a bit of code deep down in LSASS actually says "Yeah, go ahead" or "Woah! No way!"
On domain controller computers it hosts the Active Directory database. Thusly, on a domain controller computer, you will see more CPU, RAM, and IO resources consumed by this process because it's running AD. On a member server that isn't a domain controller you shouldn't see quite as big an impact.
As far as patching your boxes go, take what "Windows Update" or "Microsoft Update" says to do as the "right thing". For the most part, this will get you patched to current levels. Be careful mucking about with LSASS, because killing it will cause your computer to reboot.