I found the place to do this with jetty was in .../deploy/jbossweb-jetty.sar/webdefault.xml. There is a setting there for directory listings. I don't know if a similar setting exists when you use Tomcat.
Search for "listings" in the catalina web.xml file under <JBOSS_HOME>/catalina/conf.
By default, this is true which allows directory browsing. Turn this to false.