Upgrading security-related packages (eg. clamav, chkrootkit)

["Robert S" <robert.spam.me.senseless@gmail.com>]

I am contemplating an upgrade from woody to sarge on a work server.

A number of security-related packages such as clamav and chkrootkit need to 
be kept up to date to deal with new threats such as viruses and rootkits.  I 
understand that if I stick to the "stable" tree, I will only get critical 
security patches and won't get the latest version of the software.  For 
example, the official version of clamav is 0.84, but there will be numerous 
updates over the next couple of years, and 0.84 will become obsolete.

To keep up to date should I just use the "official" debian "stable" sources, 
or should I use "unofficial" sources (such as backports.org)?