you can configure it manually

or some basic configuration options should be available through "software-properties-gtk" under the Updates tab (unsure if this is preinstalled or not, but it is available from apt. It also might show up as "Software & Updates" in the GUI)

I don't know if debian does security updates automatically by default, I've only used it on servers lately