Drush update: How to keep file permissions?
Write a script that correct permissions, you can find an example in this article:

Securing file permissions and ownership

Execute this script manually every time a drush update is made. 

Or you can write a simple drush command that executes this script when a drush commands that cnahges files executes. Check the drush_hook_post_COMMAND:
http://drupalcontrib.org/api/drupal/contributions%21drush%21docs%21drush.api.php/function/drush_hook_post_COMMAND/7