Safe Internet

Secure Internet is a multi-component approach aimed at reducing the likelihood of users—especially children—encountering harmful content and interactions; protecting personal data, privacy, and digital identity; and ensuring account and device security.

This approach is not limited to technical measures alone: Safe internet use is shaped collectively through individual habits (such as password and authentication practices, updates, and cautious link usage), family guidance and monitoring practices, educational institutions’ digital literacy processes, and institutional risk management policies.

At the international level, guidelines on child online protection (Child Online Protection) strive to establish a common “protection and responsibility language” for sectors and institutions; while institutional cyber risk management frameworks define high-level goals and outcomes to enable organizations of varying sizes and maturity levels to systematically manage cyber risks.

Concept, Scope, and Related Terms

Secure Internet is a holistic approach that seeks to make access to internet content and services safer by taking into account users’ age, needs, and risk levels. This approach is not reducible to narrow technical practices such as blocking or filtering specific websites; it addresses online exposure to harmful content, risky interaction and communication patterns, protection of personal data, security of digital identity and accounts, device and network security, and the development of usage habits within the same framework. Therefore, the term “Secure Internet” serves as an overarching category encompassing both child online protection and the security needs of adult users in digital environments.

The scope of the concept becomes visible in practice through three main dimensions. The first dimension is content and contact safety: This includes exposure to content inappropriate for the user’s age and developmental level, being directed toward harmful communities, or facing risks of exploitation and bullying in online environments. The second dimension is data and privacy safety: Processes such as digital footprints left by online behavior, processing of personal data without consent, and collection and sharing of various data types—including location data—are central to secure internet. The third dimension is cyber security: Risks such as account compromise, phishing and fraud attempts, malware infection, or unauthorized use of devices or accounts transform secure internet into a field that extends beyond content filtering to include digital security practices.

Within this framework, several frequently used terms clarify the boundaries of the concept. Child Online Protection (COP) is an approach area that focuses on safeguarding children’s digital rights and safety, jointly addressing the responsibilities of public authorities, educational institutions, industry actors, and families. Cyber hygiene is a concept referring to the development of stable and sustainable behaviors in users’ daily digital practices—such as authentication, password management, updates, and secure connection habits. Digital security risk management refers to a governance approach that treats cyber risks not merely as technical issues but as risk domains linked to the objectives of organizations and individuals, integrating them into decision-making processes.

The concept of personal data security emphasizes protecting confidentiality, integrity, and accessibility of personal data through technical and administrative measures. Application security and its associated classifications—for example, common vulnerability categories—concretize the “service and platform security” dimension of secure internet. In this context, secure internet represents a comprehensive set of multi-layered protection mechanisms against multi-layered risk areas, rather than a single tool or institutional application.

Risk Areas from the Perspective of Children and Youth

Internet safety for children and youth is defined as an area that must be addressed holistically, encompassing content, communication/contact, behavior, and time-use dimensions. Online risks are not limited to the issue of “prohibited content”; interaction patterns that impact digital identity and privacy, harmful behaviors emerging within peer relationships, and problems related to screen time and usage habits are equally part of this framework.

Children’s conditions of internet access—such as home connectivity, ownership of personal devices, and daily usage frequency—directly affect the visibility and intensity of risks. For instance, a study conducted at the primary school level found that the vast majority of students had internet access at home (95.5 out of 100), and a significant group used the internet “every day”; this situation requires that risks be viewed not as rare occurrences but as embedded phenomena within daily practices.^【1】

Content Risks

Content risks encompass exposure of children to visuals and narratives inappropriate for their age and developmental level, which may be frightening or traumatic; violent content; hate speech; or content promoting harmful behaviors. In a large-scale field study based on parental views, reports of children encountering specific content types stood out: Nearly one in five parents reported that their children had seen content depicting “physical harm to humans or animals”; although at lower rates, content related to harmful substances, hate messages, or methods of acquiring personal information were also identified by parents as risk categories.^【2】 Content risks gain meaning not merely as “inappropriateness” but as an exposure domain that can affect a child’s emotional state and sense of security.

Communication and Contact Risks

Children encountering unfamiliar individuals online, being directed to share private information, receiving disturbing messages, or facing manipulative attempts for fraud are assessed under contact risks. Parental data suggest that such incidents are not constant for every child but cannot be dismissed as entirely exceptional: A small proportion of parents reported that their children encountered distressing or alarming events “daily,” “once or twice a week,” or “once or twice a month”; however, the majority reported no such encounters.^【3】 This distribution aligns with a pattern indicating that contact risks often emerge episodically but can have critical consequences for a child’s safety and privacy when they do occur.

Behavioral Risks and Peer Relationships

Cyberbullying relates to children and youth being subjected to or engaging in harmful behaviors such as insults, humiliation, threats, or exclusion using online tools within peer relationships. Qualitative findings at the primary school level show that teachers often interpret secure internet as “blocking access to inappropriate websites,” while awareness of cyberbullying is shaped through examples and personal experiences.

In large-scale studies among middle school students, parents evaluate their children’s online experiences under headings such as disturbing behaviors and safety precautions; cyberbullying and fraud-type risks hold a distinct place in parental narratives. Behavioral risks emerge not merely as a “technical security” issue but as an area that must be considered alongside school climate, peer culture, and home guidance practices.

Time-Use and Habit Risks

Risks associated with excessive or unmonitored internet use during childhood are closely linked to screen time, type of content, and usage motivation. In the literature, symptoms of internet addiction are discussed not only in terms of time spent online but also through connections with offline life, emotional state, and social relationships.

Assessments at the primary school level show that children’s frequency and daily duration of internet use are evaluated alongside parental perceptions of “negative impact.”^【4】 Although this area does not manifest directly as a security violation, it is evaluated within secure internet because it can affect a child’s attention, sleep patterns, and social interactions.

Measurement of Risks and the Visibility Problem

Children’s exposure to online risks often becomes visible only through the awareness of parents or teachers. The fact that some parents respond with “I don’t know” suggests that some risks may occur outside adult supervision or that children may avoid sharing their experiences.^【5】 Therefore, children’s online risk areas are assessed not merely as “exposure” but as a security issue involving recognition, reporting, and coping capacity.

Parental Mediation and Home Practices

Parental mediation is a set of practices that regulate children’s internet use not merely through “prohibition” or “time limits” but through guidance, co-use, justification of rules, and teaching of safe behaviors. Home-based mediation is shaped according to the child’s age and digital experience: In early childhood, parental control is more direct and surveillance-based; as children grow older, their autonomy increases, and mediation shifts toward helping children recognize risks and develop self-protection skills rather than relying solely on technical restrictions. Therefore, home practices are regarded as fundamental mechanisms that establish the goal of “safe internet” at both behavioral and technical levels.

Home mediation practices generally fall into three categories. The first category is rule-setting and restriction: This includes setting designated internet time, using devices in common areas, limiting access to specific apps or platforms, and selecting age-appropriate content. The second category is active mediation: This includes parents discussing content with their children, explaining risky situations through examples, encouraging children to share their online experiences by building trust, and explaining the consequences of online behaviors. The third category is co-use and companionship: Especially in preschool years, children commonly experience digital content alongside their parents, which not only reduces exposure to risky encounters but also contributes to the development of children’s digital literacy. These three categories are not mutually exclusive; they commonly coexist in households and vary in emphasis depending on needs and circumstances.

A strong relationship exists between parental mediation and risk visibility. Close monitoring of children’s digital activities facilitates early detection of certain risks; however, overly restrictive or purely technical approaches may hinder children from sharing negative experiences with their parents. Studies based on parental views show that in most families, the frequency of children encountering disturbing or alarming online situations is reported as low; this may indicate the effectiveness of some home measures but also suggests that risks are not always visible due to limitations in awareness and reporting. Similarly, parental responses of “I don’t know” regarding specific risk types reveal that not all aspects of children’s online life are subject to adult oversight; thus, mediation is directly linked not only to control but also to the ability to establish communication channels.

Home practices can acquire a more systematic character when supported by technical tools. Filtering and profile-based access models can be used to create age-appropriate content environments; however, parental evaluations and educational studies consistently emphasize that such tools alone do not generate sufficient security and that their effectiveness remains limited without parental guidance and communication with the child. Moreover, technical measures used at home—such as strong passwords for accounts, multi-factor authentication, and regular device updates—indirectly influence the child’s digital security culture; when parents explain these practices with their rationale, children learn security not as a “rule” but as a meaningful set of behaviors.

The effectiveness of parental mediation depends on variables such as the family’s level of digital literacy, the purposes for which the child uses the internet, and the home’s device and connectivity setup. Therefore, home practices are viewed not as a standard “recipe” but as a continuous adjustment process tailored to the child’s age, developmental needs, and encountered risk types. Within this framework, mediation serves not only as a protective practice aimed at helping children cope with online encounters but also as a socialization process that lays the foundation for developing responsibility and self-regulation in digital environments.

Educational Institutions and Digital Literacy

Educational institutions hold a decisive position in the dimension of secure internet that goes beyond “technical measures,” particularly through their roles in digital literacy and preventive education. As children’s age of first internet exposure decreases, online environments become a natural part of daily communication and learning practices. This situation does not limit the school’s role to cognitive learning outcomes alone; it also requires systematic support in helping students recognize online risks, develop safe behaviors, gain awareness of privacy and digital footprints, and understand their rights and responsibilities. Schools function as a common learning ground that can balance differences in digital experiences brought by students from diverse family and socioeconomic backgrounds, thereby playing a functional role in the social dimension of secure internet.

How teachers interpret secure internet directly affects the nature of school-based practices. In a qualitative study conducted at the primary school level, teachers’ understanding of secure internet was frequently shaped within the framework of “blocking access to inappropriate websites”; conversely, areas such as cyberbullying, privacy, and online communication risks were more often brought to the agenda through case examples and daily experiences.^【6】 This pattern indicates that if secure internet in schools is addressed solely through technical filtering logic, a significant portion of risks—particularly those related to peer relationships and behavioral risks—may remain secondary in the educational agenda. Therefore, the educational approach to secure internet requires a pedagogical framework that goes beyond “access barriers” and aims to recognize the diverse risk types students may encounter in their online world and develop behavioral responses to them.

Digital literacy emerges as an overarching concept in the educational dimension of secure internet. Digital literacy includes not only skills for content verification and critical thinking but also components of security such as protection of personal data, account security, safe password and authentication habits, understanding of sharing and visibility settings, and distinguishing risky links and messages. Teaching this area in schools helps students perceive the concept of “risk” not as an abstract threat but as a tangible reality linked to everyday online behaviors. Moreover, the school environment provides a context in which the normative language of secure internet—respect, rights violations, privacy, consent, responsibility—can be concretized within students’ peer relationships.

Another critical dimension of school-based secure internet approaches is reporting and referral mechanisms. In cases of cyberbullying, online harassment, or exposure to disturbing content, it is essential that students know whom to inform and how, and that schools have clear procedures for handling such reports; this strengthens protective capacity. At this point, the roles of teachers and counseling services are two-fold: On one hand, listening to students in a non-blaming manner and providing safe support channels; on the other hand, developing a proactive stance to prevent the transfer of bullying and exclusion practices from offline to online environments by monitoring classroom climate and peer relationships. Qualitative findings indicate that teachers often tend to address secure internet through a “control/block” lens; thus, the structured integration of reporting, guidance, and social learning components becomes essential.

The role of educational institutions is not limited to student-focused instruction; family-school collaboration is a complementary element for the continuity of secure internet. Alignment between home mediation and messages delivered at school facilitates consistent behavior by students across different contexts. Especially among younger age groups, school-led awareness and information campaigns for parents contribute to establishing a communication foundation that enables discussion of children’s online behaviors, rather than relying solely on technical measures. Within this framework, schools position secure internet not as a “list of prohibitions” but as a social learning space that cultivates skills in recognizing risks, making safe choices, and seeking help when needed.

Key Cyber Threats for Individuals

For individual users, internet safety is not reducible to the issue of “harmful websites” or “inappropriate content”; it is a security domain encompassing various threats targeting a person’s digital identity, accounts, devices, and personal data. In daily usage practices, risk often begins not with technical infrastructure but with persuasion and manipulation mechanisms targeting users; therefore, individual threats include both technical attack methods and social engineering-based manipulations.

Phishing and Social Engineering

Phishing is a type of attack that aims to obtain passwords, authentication codes, card details, or personal data by deceiving users through messages, emails, links, or fake websites that appear to come from trusted institutions or individuals. Individuals are often triggered into action by messages creating urgency, such as “urgent action required,” “your account will be suspended,” or “you have won a prize.” This threat type exploits weaknesses in users’ attention and decision-making processes rather than seeking technical vulnerabilities. Fraud scenarios may also proceed through methods such as fake payment pages, impersonated customer service, or identity spoofing in messaging applications.

Account Compromise and Authentication Vulnerabilities

Account compromise occurs when unauthorized access is gained to a user’s email, social media, banking, or other digital service accounts. This often happens through weak or reused passwords, password leaks, excessive permissions granted to third-party applications, or login credentials obtained via phishing.

Account compromise does not merely result in loss of access to the affected service; it can lead to cascading risks for other accounts linked to the same email address, dissemination of harmful content and links from the compromised account, and identity fraud. Multi-factor authentication (MFA) and other additional verification mechanisms emerge as critical countermeasures in this risk area.

Malware and Device Security

Malware refers to software designed to perform unauthorized actions on devices, steal data, disrupt systems, or expose users to further attacks. Trojans, spyware, adware, botnet components, and ransomware are different examples within this broad category. Malware infection can occur through fake software updates, pirated software packages, email attachments, messaging links, or seemingly trustworthy websites. At the individual level, device security is not limited to antivirus use; it also includes regularly updating operating systems and applications, avoiding software downloads from untrusted sources, and maintaining basic security settings that prevent unauthorized access.

Data Breaches, Privacy Loss, and Digital Footprints

A significant portion of cyber threats to individuals is related to the exposure or misuse of personal data. Data breaches may not stem directly from user error; they can result from leaks at service providers, exposure of email and password combinations, and subsequent testing of these credentials on other platforms (credential stuffing), leading individuals to be placed at risk involuntarily. In addition, privacy loss can arise through open profile settings, excessive sharing, uncontrolled visibility of location data, or granting unnecessary permissions to applications. Privacy risks extend beyond “data theft” to encompass broader frameworks such as monitoring of online behavior, profiling, and potential use of such information for various purposes.

Unsecured Networks and Connection Risks

Open or poorly secured wireless networks, especially in public areas, can increase risks of data eavesdropping and session hijacking. In this context, risk is not only tied to the technical security of the network but also to the conditions under which users perform sensitive actions (banking, authentication, password changes). Secure connection habits include avoiding sensitive transactions on untrusted networks, paying attention to HTTPS usage, and controlling device automatic connection settings.

Application and Service-Related Risks

As individuals increasingly conduct more activities through mobile applications and online platforms, vulnerabilities in application design or misconfigurations can also affect individual security. Weakly designed authentication flows, authorization errors, data integrity issues, or insecure data storage practices can generate risks even without user error. Therefore, individual threats must be assessed not merely as a matter of “user attention” but in conjunction with the security level of the services themselves.

Key cyber threats for individuals are often interconnected: Phishing can lead to account compromise; account compromise can result in personal data leaks; and data leaks can create conditions for new phishing and fraud attempts. Therefore, individual cyber security requires a layered protection approach supported by daily usage habits, rather than isolated measures.

Protection and Prevention Methods

The protection dimension of secure internet is not reducible to a single tool or behavior; it is a comprehensive set of complementary measures including identity-account security, device and software security, connection security, data and privacy management, and incident response habits. These measures become visible at the individual user level as “cyber hygiene”—daily security practices—while being supported at institutional and service provider levels by more systematic policies, processes, and technical controls. The fundamental logic of the protection approach is not to eliminate risks entirely but to reduce their likelihood and limit their impact when they occur.

Authentication and Account Security

The core of individual security lies in protecting online accounts. Key measures in this area include:

• Use of strong and unique passwords: Reusing the same password across multiple services can rapidly expose other accounts if any data leak occurs. Therefore, it is essential that passwords be differentiated across services and avoid easily guessable patterns.
• Multi-factor authentication (MFA): Provides an additional security layer that makes account access difficult even if the password is compromised. MFA is especially effective for accounts such as email, which serve as “keys” to other accounts.
• Account recovery security: Recovery email addresses/phone numbers, security questions, and device authentication settings become critical in account compromise scenarios. Neglecting this area can render even strong passwords and MFA ineffective.
• Session and device control: Regularly reviewing linked devices and active sessions enables detection of unrecognized logins.

Device, Software, and Application Security

Risks of malware infection and unauthorized access often stem from weaknesses in device security. Therefore:

• Regular application of updates: Operating system and application updates are fundamental measures for closing known security vulnerabilities. Delaying updates can expand the attack surface.
• Obtaining software from official sources: Untrusted links and pirated software packages increase malware risks. A cautious approach toward sources outside official app stores is considered the “lowest-risk” behavior.
• Basic security software and permission management: While security software alone is insufficient, it can block known threats and alert users. Additionally, avoiding unnecessary permissions for applications (location, microphone, contacts, etc.) is important for privacy and data security.

Connection Security and Safe Browsing Habits

A significant portion of attacks against individual users are triggered by simple actions such as “clicking” or “downloading”; therefore, safe browsing habits play a protective role:

• Suspicion of links and attachments: Verifying links in emails and messaging apps and avoiding unexpected attachments reduces phishing and malware risks.
• Avoiding sensitive transactions on unsecured networks: Avoiding sensitive actions such as authentication, money transfers, or critical account operations on open Wi-Fi networks reduces risks of session hijacking and data eavesdropping.
• Browser and account synchronization security: Browser extensions, automatic password filling, and habit of keeping sessions open can create risks while offering convenience. Therefore, regular review and minimal extension usage are important.

Personal Data and Privacy Management

The privacy dimension of secure internet gains meaning not only through “data theft” but through who accesses data, for what purpose, and to what extent. Effective individual-level measures include:

• Limiting sharing: Uncontrolled sharing of personal information, location data, daily routines, or details about family members can increase risks of targeted fraud, harassment, and social engineering.
• Adjusting privacy settings: Visibility, tagging, message request filters, and data sharing options on social media and platforms directly affect privacy risks.
• Reviewing permissions and third-party access: Permissions granted through “Login with account” connections can accumulate over time and weaken account security.

Incident Response and Harm Mitigation Habits

The protection approach includes knowing what to do when an incident occurs. Key individual-level response steps include:

• Password change and session termination: Immediately changing passwords and terminating all active sessions upon detection of suspicious logins.
• Enabling MFA and updating recovery information: Reduces the risk of repeated account compromise.
• Device scanning and security check: Scanning the device under suspicion of malware, and undertaking more comprehensive interventions such as clean reinstallation if necessary.
• Halting transactions under fraud suspicion: Contacting banking channels promptly and monitoring account activity if card or payment details have been shared.

Institutional-Level Approach

For institutions, secure internet is linked not only to education supporting users in developing safe behaviors but also to risk management approaches and standards-based security governance. Institutional-level preventive measures are typically grouped under headings such as asset and access management, secure configuration, security monitoring, incident response plans, supply chain security, and application security controls. These measures constitute a “process and control architecture” that can be viewed as the institutional counterpart of individual cyber hygiene.

Protection and prevention methods generate a security practice that addresses both user behaviors and technical controls, unlike isolated solutions such as content filtering. Therefore, secure internet is defined as a protection system sustained by daily usage habits and operating in a layered manner against diverse risk types.

Secure Internet in Türkiye: Model and Implementation

In Türkiye, the concept of “secure internet” has taken concrete form not only in its general meaning but also as a service model enabling profile-based regulation of internet access. This model was brought onto the institutional agenda in response to growing societal complaints and demands regarding safe internet use; regulatory efforts were grounded in constitutional provisions on “protection of the family and children’s rights” (Article 41) and “protection of youth” (Article 58). Implementation was addressed through relevant board decisions as “procedures and principles regarding secure internet use” and later reorganized under the title “Procedures and Principles Regarding the Secure Internet Service.” The service began on 22 November 2011.^【7】

Nature and Core Operational Logic of the Service

The Secure Internet Service is defined as a free, on-demand, and alternative internet access service delivered through the infrastructure of internet service providers. Users adopt this service voluntarily based on personal preference, not as a mandatory requirement. Three core principles underpin its operation:

• Voluntary participation: Users choose to enroll in the service themselves.
• Flexibility: Users can modify their selected profile at any time.
• Exit option: Users can opt out of the service at any time (terminate profile usage).

This structure positions secure internet not as a single “blocking system” but as an access regulation option activated according to the user’s own preference.

Profiles: Child Profile and Family Profile

The service consists of two profiles: Child Profile and Family Profile. The profile approach aims to provide varying levels of protection according to users’ risk perception and needs, rather than reducing access to a binary of “fully open” or “fully blocked.”

The Child Profile is defined as a profile containing “beneficial websites” and is structured around a framework of approved sites. Examples from a broad range of categories related to education and daily life are provided: education, culture, arts, business, economy, homework, banking and finance, career, shopping, health, music, news, email, official/public websites, travel, private companies, educational institutions, and e-government are all considered “beneficial site types” included in the child profile. This definition establishes the logic of the child profile not as “filtering out risky content” but as “granting access to a set of content deemed safe.”

The Family Profile defines a broader access area compared to the child profile but is described as a profile that excludes certain risk categories. Content types excluded in the family profile include gambling, suicide promotion, child sexual abuse, facilitation of drug and stimulant use, procurement of hazardous substances for health purposes, prostitution, obscenity, racism, discrimination, hate speech, terrorism, violent or brutal imagery, blood and violence in combat sports, animal fighting, fraud, and malware.

Additionally, the family profile allows access to personal sites, forums, and sharing platforms beyond the child profile. Furthermore, the availability of specific restriction options for gaming sites, chat sites, and social media types demonstrates that the profile approach is supported by a selective restriction logic rather than a blanket blocking approach.^【8】

Subscription and Access Channels

The subscription process is linked to methods provided by the internet service provider. Channels such as call centers, SMS, agents, or online service centers can be used to activate the service. The ability to modify profiles after subscription is one of the details demonstrating that the service is designed as an adjustable option rather than a one-time decision.

Within this framework, Türkiye’s secure internet model is defined as a service that, on one hand, aims to reduce content and interaction risks through profile-based access regulation, and on the other hand, operates according to principles of user choice and flexible usage.^【9】

International Frameworks and Standards

The international approach to secure internet reflects a multi-layered perspective that goes beyond the notion of a “single technical solution”; it is shaped through child online protection, digital security risk management, institutional cyber security frameworks, and daily usage practices (cyber hygiene). These frameworks acknowledge that risks are not merely technical but also social and managerial, and define the responsibilities of different actors (families, educational institutions, public authorities, service providers, and the private sector).

Child Online Protection (COP) Approach

The International Telecommunication Union’s (ITU) COP guidelines treat child online safety as a multi-stakeholder protection domain. A distinctive feature of this approach is that its goal of reducing risks children face is linked not only to tools such as filtering and blocking but also to components such as age-appropriate product/service design, reporting and complaint mechanisms, operational processes for content and communication safety, awareness and education, privacy principles, and inter-stakeholder coordination. Within this framework, “secure internet” is positioned as a domain that simultaneously considers children’s digital rights and protection needs, bringing together technical and governance measures under a single umbrella.^【10】

Digital Security Risk Management (OECD)

The OECD’s approach to digital security risk management defines security not as a checklist of technical compliance but as a risk management issue affecting economic and social activities. In this perspective, risk is not an absolute threat to be eliminated but an element evaluated, prioritized, and managed in relation to specific goals and activities. For institutions, this approach emphasizes integrating cyber risk into corporate governance, incorporating it into decision-making processes, considering dependencies with stakeholders (supply chains, service providers, user ecosystems), and evaluating security decisions in terms of cost-benefit balance. Within the context of secure internet, this framework elevates the question “Which risks are linked to which usage purposes?” to a foundational principle.^【11】

Institutional Cybersecurity Framework (NIST CSF 2.0)

The NIST Cybersecurity Framework (CSF) 2.0 provides a framework language for structuring cybersecurity at the institutional level along strategic, governance, and operational axes. One of the key innovations in CSF 2.0 is the explicit inclusion of the “Govern” function; this underscores that cybersecurity is not solely the responsibility of technical teams but must be addressed through institutional policies and accountability mechanisms.

The framework’s functional logic (govern/prevent/detect/respond/improve type security lifecycle) enables institutions to systematically discuss cybersecurity regardless of their maturity level. In the context of secure internet’s “institutional and service security” dimension, CSF highlights concepts beyond technical controls: roles, responsibilities, measurement, and continuous improvement.^【12】

Cyber Hygiene and Best Practices (ENISA)

ENISA’s approach to cyber hygiene links the sustainability of secure internet at both individual and institutional levels to the regular application of daily practices. Cyber hygiene is presented as a set of behaviors encompassing “fundamental yet critical” practices such as password and authentication, update and patch management, backup, secure configuration, awareness of suspicious links/attachments, and regular monitoring of devices and accounts. This approach establishes security not through isolated measures requiring high expertise but through repeatable and monitorable practices accessible to a broad user base. Thus, it reinforces the assumption that secure internet will remain limited if not supported by user behaviors.^【13】

Application Security Risk Classifications (OWASP)

Another international pillar of secure internet concerns the secure design of online services and applications. Risk classifications provided by organizations such as OWASP categorize common vulnerability types, creating a shared risk language for developers and service providers. These classifications make visible areas such as authentication and authorization errors, data integrity issues, insecure data processing/storage practices, and design-related vulnerabilities. From the user’s perspective, this framework reminds us that risk cannot be explained solely by “user error”; the security design of services is also a decisive component of secure internet.^【14】

National-Level User-Focused Guidance (USOM)

Individual security recommendations provided by the National Cyber Incident Response Center (USOM) establish a guidance line that strengthens the practical dimension of secure internet in alignment with international frameworks. Such guidance targets daily user behaviors and highlights concrete measures users can adopt, particularly in areas such as phishing/fraud, account security, updates, and safe usage habits. Thus, secure internet gains an application-oriented support domain that directly connects conceptual frameworks and standards with user practices.

When evaluated together, these international frameworks and standards reveal that “secure internet” emerges as an approach area that unites child protection with institutional cyber risk management within a broad framework, distributing security across technical measures, governance principles, and daily usage practices.^【15】