In most places I've worked, unauthenticated remote services are banned outright. As you say, authentication on its own isn't a particularly strong control if t

In most places I've worked, unauthenticated remote services are banned outright. As you say, authentication on its own isn't a particularly strong control if there's no authorization. Logging and monitoring are also required for them at a minimum. Adding authorization might involve business logic changes I guess, but who is authorised is a business decision achieved with config/administration, not hard coded into the software... I would hope!