Information and telecommunication infrastructures and services are key constitutive element of our society. They require not only cyber security but also an appropriate level of confidence in it. This paper explores at a societal level the main challenges, obstacles and constitutive elements that contribute to building confidence in cyber security by revisiting some fundamental concepts. The aims of this paper are to: (1) Identify some key global elements that should drive the development of information security from a long-term risk management perspective at a societal level; (2) Point out the complexities inherent in implementing security in vulnerable ICT environments; (3) Clarify the need for mastery of indicators and methodologies that contribute to identifying and operating good risk and security management practices and building confidence in these.