I have always used "Network Service" as the application pool identity for Sitecore since 6.0 through 8.1 and never had any problems. A co-worker stated recently that the "AppPoolIdentity" is the recommended version for 7+. What is the recommended identity?
You can use either, but I recommend
ApplicationPoolIdentity whenever possible. TBH, your question really isn't Sitecore-specific, but the below info should help to get you started.
Application Pool Identity vs NETWORK SERVICE
The security of
ApplicationPoolIdentity will always be greater than or equal to that of
NETWORK SERVICE, given that the same access rights are applied to both.
AppPoolIdentity, you have a separate identity (security account) for each app pool. This means that you can control the services and securities for your application pool, specifically, agnostic of any other application pools or services. In other words, if you have multiple services and/or applications then
ApplicationPoolIdentity is more secure, otherwise it is pretty much the same, though
ApplicationPoolIdentity is more extensible (and a bit easier to read in Windows Event Logs, IMHO).
NETWORK SERVICE can be used for any/all of your services, i.e. it can be used by more than one without issue. While this sounds like a nice feature that might save you some time, this actually means that if you use it your securities cannot be controlled on a service-by-service or application-by-application basis. All services and/or applications that use
NETWORK SERVICE will have the same permissions, which can be a pretty big security risk.
Food for Thought
Imagine that you use
NETWORK SERVICE on your site and you also happen to use
NETWORK SERVICE on an IIS-based service that a hacker manages to break into. Imagine that the hack allows the hacker to access the server's file system. Because you used
NETWORK SERVICE for the application pool's security account, the hacker now has access to your site's folder and to anything that your site had access too. Now, the hacker can not only gain access to your site's ConnectionStrings and web.config, but also to things in your System folder (since Sitecore requires access to some of the System folders), your databases (since they have your ConnectionStrings), and beyond!
This post from iis.net gives a good description of the different security accounts that you can use and their similarities/differences.
From the installation guide I can see Sitecore recommend ApplicationPoolIdentity or NetworkService.
on chapter 4.3 Configuring the IIS
More information about Application Pool Identities : https://www.iis.net/learn/manage/configuring-security/application-pool-identities