There are multiple options to do this apparently. One very good reference that compiled those for me is:
https://www.owasp.org/index.php/Securing_tomcat
This talks about Tomcat 5.5 primarily. But I see little reason why most of it should not work for higher versions of Tomcat namely 6 or 7.