You have to differentiate between web services security and WS-Security. The former is the general concept of securing web services, while the latter is an OASIS standard that prescribed various security-related features that can be used to achieve web services security. The main features of WS-Security are authentication (both username/password and certificates), signature and encryption.
Since web services are overwhelmingly based on HTTP, the HTTP security features (authentication and encryption via SSL/HTTPS) can also be used. But that should be considered obsolete; these days, to secure a web service, the features of the WS-Security standard should be used. Popular WS engines (like Axis) come with WS-Security support built in. [ July 05, 2007: Message edited by: Ulf Dittmer ]