How do I address security concerns with Terminal Services?

I want to persuade some of our insurance clients to use our applications over terminal services but they have resisted in the past on security grounds. They seem to consider opening up a port to be too risky and would rather have a web version of the product.

Has anyone come across or created a document/presentation that would help me convince them that this is a secure solution?