Service Packs, Security Updates and Cumulative Updates

I would like to find a  document that would help me understand and clarify Service Packs, Security Updates and Cumulative Updates versions and relationships.

Things like. Cumulative Updates include old Security Updates. Cumulative Updates do not overwrite applied Security Updates, etc.

For instance,

I am upgrading a server from: 10.0.5512 (SQL 2008 SP3, After Security Update MS12-70)  To: 10.0.5861 (SQL 2008 SP3 CU17).

Would the MS12-70 (2754849) I installed still be present after installing CU17? The reason for doubt was that I saw another version of MS12-70 that includes CU 1 to 7(KB2716435). So makes me wonder about it.

I am probably not able to explain myself right but, the idea is to find a document that can explain how the build information and versioning works. 

Some how I have the idea that Cumulative updates would not include Security Updates.

Thanks beforehand

Paulino