"The internet is a shared global resource that should be protected," Scott Charney, corporate vice-president, Trustworthy Computing, Microsoft told the ISSE 2010 security conference in Berlin.
But, he said, despite discussion by governments on deterring cyber attacks, people are having a hard time understanding the threat and deciding what the response should be.
Most governments are seeking to define a single strategy, said Charney, but the fact is that they need four different strategies to deal with cybercrime, economic espionage, military espionage and cyber warfare.
These all make up the cyber threat, yet each is different, and requires a different approach, he said.
"Cyber warfare is the most difficult because there is no clear definition and it is difficult to say where the other three kinds of threat end and cyber war begins," said Charney.
One of the biggest problems is not knowing who is attacking or why, but doing nothing is not an option, he said, particularly against the growing problem of botnets in all four categories of attack.
According to Charney, one possible approach to addressing botnets is implementing a global collective defence of internet health, much like we see in the world of public health.
"We need to improve and maintain the health of consumer devices connected to the internet in order to avoid greater societal risk," he said.
To realise this vision outlined in a paper published by Microsoft, Charney said governments, the IT industry, internet access providers, users and others will have to take steps to evaluate the health of consumer devices before granting them unfettered access to the internet or other critical resources.
This would mean setting up a system of issuing health certificates to individual machines that pass certain minimum standards, and blocking or limiting the access of machines without valid health certificates.
Cyber security policy and legislation is being discussed in many countries around the world, and there is a huge opportunity to promote this internet health model, he said.
But, as part of this discussion, he said it is important to focus on building a socially acceptable model that achieves better security without eroding privacy.
"With examples like France's Signal Spam or Japan's Cyber Clean Center as models, industry and governments need to build upon the successes to more systematically help improve and maintain the health of internet-connected systems and to disrupt cybercrime and other threats to individuals and society," he said.