A B757-200 pilot reported lack of information about when to shut down passenger internet access when security concerns arise.

Narrative

We received a 'Confirm ops normal' message about halfway through the flight; with no further communications from the Company regarding any potential security concerns. We had no way of knowing whether this was: 1) A test; 2) A problem with another aircraft; or 3) A problem with our aircraft. This poses a unique set of issues because our aircraft had a live internet connection for the passengers. In the case of #2 above; there is a very real possibility that our passengers could have found out about it before we did. This would be especially bad in the remote (although it's happened before) instance of a coordinated attack. In the case of #3 above; our passengers could be using the internet to communicate with each other to plan something for our aircraft. In either case; this puts the Captain; as the In-flight Security Coordinator; in the position of being the last person to know what the heck is going on. For this reason it is my suggestion that our SOP be amended to require that the internet switch be turned off immediately upon receipt of any 'Confirm ops normal' message and remain off for the remainder of the flight. At a minimum; it should be turned off until the reason for the message can be determined. Our flight manual is currently not very specific about this. It states that the switch can be turned off for security reasons; but it doesn't specify what those reasons may be or actually require anything. I spoke with the Dispatch Manager on duty after the flight; and he confirmed the reason for the message. He was also unaware that some of our planes have a live internet connection for the passengers; and he agreed that this could pose a potential security issue.