So, you've created a Drupal site, customized a few bits here or there of Drupal core to satisy your client, and everyone's happy.
Then, a new security update is released. Suddenly those changes look in danger of being overwritten with the upgrade. What to do?
If your changes are just tweaks rather than a major rewrite, the following two-stage upgrade process has always worked well for me. You will need the original Drupal files of your currently installed version ('base'), and a copy of the new version files in another directory ('new'). You also need access to a copy of your production server Drupal files ('live').