Sandy Hook school staff and administrators did everything they could security-wise, from plans to systems to procedures to drills. But a determined attacker willing to die will sometimes get through. At that point security is about response and mitigation.
Security is a component of risk management, not risk elimination. Reasonable physical security measures, especially for a public building or place of business, are designed to detect and delay an intruder, allowing people to take appropriate action.
The school security plan involved locking doors during the day, with a visual monitoring system used to allow entry. This did not prevent the gunman from shooting his way into the building, however. Most school districts - even those in affluent communities - have limited funding for measures such as bulletproof glass, man traps, or sophisticated access control.
Credit needs to go to those teachers who, trained in lockdown procedures and what to do in this situation, responded quickly and correctly to the crisis, and kept their students out of harm's way. The last line of security is the individual, and by all accounts they performed that function to the best of their abilities. Using the class announcements PA system to warn the other classrooms was also reportedly effective in communicating the danger, and in allowing other teachers time to move their students out of sight.
In addition, emergency response to these types of events has come a long way since Columbine. Police are now well-trained to deal with active shooters in school environments, and how to react quickly in order to minimize loss of life. The use of Reverse 911 in notifying parents of the crisis was also particularly effective. The lessons learned from other events such as this are used by first responders across the country, even in small towns where "no one expects things like this to happen here."
The perpetrators of these crimes will always seek out the softer targets, so our security awareness will need to raised in more and more areas - places where we may be unaccustomed to it. Vigilance and knowing what to do in these situations is key.