This paper investigates the link selection policy for secure communications over a buffer-aided two-hop communication link. It is assumed that a source wishes to send information to a destination with the aid of a trusted half-duplex relay node compromised by a passive eavesdropper, and that there is no direct link between the source and the destination. The buffer-aided relay forwards the information to the destination by employing the decode-and-forward (DF) scheme. Both the source and the relay transmissions are assumed to be vulnerable to the eavesdropper. The perfect channel side information (CSI) of the network is assumed to be available at the source and the relay. A link selection policy with on/off power control that both the source and the relay transmit with fixed transmission power levels is derived. It is shown to achieve near-optimal performance as the average transmission power levels at both the source and the relay approach to infinity. A low complexity and asymptotically optimal on/off power control joint link selection is then proposed. Numerical results demonstrate that the proposed link selection policy with on/off power control can achieve superior performance over constant power link selection policies. Overall, the impact of on/off power control on the performance of buffer-aided secure communication over two-hop systems is characterized.