In general you want to minimize the number of programs which can reach the Internet, this includes both access and server. One of the questionable programs which asks for access is the Generic Host Process (svchost.exe). This program handles many services so you can not discriminate which service will get to access the Internet. For example if a malware had installed a virus as a service then it could transmit your personal information back to virus home base through the Generic Host Process.
So, you might think, just do not allow it Internet access, keep it to the Trusted network.
However, Windows Update also uses it for getting updates from Microsoft.
The recommendation is then to only allow the Generic Host Process access to the Internet when you are doing updates.