Blanket access to non-ejb classes and resources should be disabled by default in the org.jboss.web.WebService:

<mbean code="org.jboss.web.WebService"
name="jboss:service=WebService">
<attribute name="Port">8083</attribute>
<!-- Should resources and non-EJB classes be downloadable -->
<attribute name="DownloadServerClasses">false</attribute>
<attribute name="Host">${jboss.bind.address}</attribute>
<attribute name="BindAddress">${jboss.bind.address}</attribute>
<!-- Use the default thread pool for dynamic class loading -->
<depends optional-attribute-name="ThreadPool"
proxy-type="attribute">jboss.system:service=ThreadPool</depends>
</mbean>