The best practice is to find some way to implement your feature that does not require patching the original module. Sometimes this is not possible due to lack of available hooks to provide the functionality that you want.
In these instances, you can try out some of the patch-management solutions, such as bandaid or drush-patchfile, which might help you out here.
Sometimes, though, the changes made in the security update will prevent your patch from applying cleanly; in this case, you have no choice but to re-roll the patch, and figure out what changes need to be made to get it working again. This makes your site maintenance much less convenient, so it's always best to try to work with the module maintainer, and see if you can get your feature added as a standard part of the module, or, failing that, perhaps get the maintainer to add the hooks that would be needed to add in the feature without patching.