Security best practices for Windows Server Update Services (WSUS)

For example, you can create a certificate request and send that request to a known certificate authority (CA), such as Verisign or GeoTrust

Such a certificate isn't cheap.

Three years ago, I asked our manager to buy such a certificate. Upon seeing the price, they said, "Define your security parameters. What exactly do we get if we move our Intranet traffic over HTTPS?" I had nothing.

To help provide additional protection from potential malware attacks, Microsoft recommends using HTTPS with Windows Server Update Services (WSUS).

Alright same question here: Please define your security parameters. How does HTTPS exactly protect against malware attacks here? A decade ago, anyone inside Microsoft who proposed such a threat drew a diagram detailing the attack steps and explaining how HTTPS protects against it. I'm not exactly asking for a diagram here, but yes, I need those details. Managers ask me for them.