Deciding which security implementation is best for a Web service begins with looking at two key security principles: authentication and authorization.