Cyber war needs "rules of engagement" to help prevent any cyber disasters from happening, world leaders are likely to be told today.
The EastWest Institute, a New York-based think tank, has drawn up a proposal, which it plans to deliver at the Munich Annual Security Conference, BBC's Newsnight programme reported.
One delegate at the event will be Prime Minister David Cameron, but US secretary of state Hillary Clinton will also be present.
German Chancellor Angela Merkel and Russian foreign minister Sergei Lavrov will also be in attendance.
It is the first time cyber security has been on the event's agenda and the EastWest proposal talked of "rendering the Geneva and Hague conventions in cyber space."
The think tank's draft document of the proposal spoke of defining the territories and players in the cyber world and said concepts of peace and war may be too simple when discussing internet-based conflict.
Businesses should also be included in the debate over cyber warfare, according to EastWest.
"Cyber weapons can deliver, in the blink of an eye, wild viral behaviours that are easily reproduced and transferred, while lacking target discrimination," the document read.
Furthermore, separating civilian and military targets is not so easy, the think tank's draft said.
Would rules of engagement work?
Frank Coggrave, general manager in Europe, the Middle East and Africa (EMEA) for Guidance Software, had his qualms over whether rules of engagement could actually work in cyber warfare.
"One of the challenges for this is, how do you know if an attack is state sponsored?" Coggrave said.
"It's very difficult to attribute it."
However, if both "kinetic warfare" covering physical acts of war and cyber attacks happen in conjunction, then it may be possible to introduce rules of engagement, he said.
Governments "should be paranoid" about the cyber threat, Coggrave told IT PRO.
"The amount of damage cyber events can do to a country is quite significant," he added.
"If someone wanted to take down the UK's water infrastructure, they could do it."
Most businesses have protections in place to secure the corporate network against mass attacks, using technologies such as antivirus, Coggrave explained.
Many do not have protections in place against targeted attacks though, he said.
"What we are seeing is organisations saying 'we have to prepare for a specific attack,'" Coggrave added.
"Antivirus would never have protected against Stuxnet."
