When you deploy Web applications and EJBs (or enterprise applications containing either of these) the Install Application Assistant prompts you to select a security model for the module that you are deploying (see Use roles and policies to secure resources).
To set the security model that the Install Application Assistant presents as selected by default: