The security informations and configurations are majorly on the server side. On the server we have the XML files (jboss-wsse-server.xml & $JBOSS_HOME\server\xxx\deploy\jbossws.sar\META-INF\standard-jaxws-endpoint-config.xml) along with the certificates. And then we have annotations to make the web service encrypted.
On the client side we have our xmls (jboss-wsse-client.xml & standard-jaxws-client-config.xml) along with certificates (fPublic Key) so that our client has encryptaion details also.