if you are only picking one based off the resources it consumes then your choice is invalid. Both options when configured properly run just fine and can have the same level of security. Both have pros and cons just like everything in life. I guess my thought would be what are your plans with whatever your running? I have always ran apache simply because its what i am used to but in no way would i ever say it's better simply because both options serve the same purpose in the end. you can agually use nginx as a front end to apache to help deal with slow http attacks as well. so you can actually use both