Whilst this may not be a good idea if you don't have infrastructure to keep on top of upgrades & security issues, the setting can be found in:
Administer > System Settings > Misc.
the notifications are set in the dababase in the civicrm_setting table (along with lots of other useful little settings :))
From the "name" column, we can ascertain that:
//Disable new version messages
$civicrm_setting['CiviCRM Preferences']['versionAlert'] = 0;
//Disable Security Messages
$civicrm_setting['CiviCRM Preferences']['securityUpdateAlert'] = 0;
global $civicrm_setting;
// Disable new version messages
$civicrm_setting['CiviCRM Preferences']['versionAlert'] = 0;
// Disable Security Messages
$civicrm_setting['CiviCRM Preferences']['securityUpdateAlert'] = 0;
will disable all of the notifications.
See Chris' answer - it's important to have the infrastructure to take care of upgrades!