The RPC standard is an unsecured (usually) webserver that communicates via standard HTTP messages (GET/POST/PUT/etc). If unsecured (and maybe parity provides the ability to secure it with certs of some kind), this means anyone who can access the port it's listening on will be able to control all functions exposed by that RPC.
The IPC endpoint, on the other hand, is a named pipe on the filesystem, that is protected through all the normal filesystem permissions means. This means if the user/group lacks permissions to the file handle for the pipe, they won't be able to read/write it. You could even configure the IPC pipe to be read-only for some users, and read/write for others.
Parity allows you to configure the IPC interface via a configuration file at the very least, and likely through command line flags, as well. From the web3 side, you would replace
Web3.providers.IpcProvider("/path/to/ipc", net), where
net is a reference to the nodejs
net lib (e.g.
var net = require('net');).
It's also worth pointing out that Parity appears to let you configure the interface that the RPC listens on, which allows you to limit it to just the "local" interface, by default. This puts it closer to the level of security (potentially) offered by the IPC endpoint, by restricting access to only local users. However, it still doesn't offer the per-user/per-group level of control that the IPC interface provides.