Entering a large public venue like a stadium or concert arena today means passing through security screening. It's not like the security screening you'll get at the airport, but they are definitely checking bags. If you want to see a football game at FedEx Field, you're limited to a clear plastic bag - no purses or backpacks allowed.
What the perpetrator did in this case is what we've been talking about for the last several months, and that is going after the soft spots outside the secure areas. It's interesting to note that this person seems to have traveled by train to get to the arena, but did not set it off there like the Paris attack from a few months ago. Many public transportation systems, especially the one in England, have placed a greater emphasis on security since the London and Spanish train bombings several years back. The CTA in Chicago is one of many transit systems that uses random checks of passengers, or sets up ad hoc screening at stations. My guess however is that if the bomber had come up against a situation where they would have been exposed, we'd be talking about a train bombing and not a concert bombing.
The harsh truth of the situation is this: you can keep pushing security out further and further, but those with malicious intent will always seek out the soft targets. Unless you start screening people when they exit their homes, you are not going to be able to stop 100% of these attacks. And if they can't use a bomb, they will use some other means to cause mayhem and fear: trucks, cars, guns, knives - whatever tools they have at their disposal.
There are ways to counter this threat. One is increased security awareness for everyone - and not just in public either, but what your friends, family, and coworkers are doing. I have no doubt that news stories in the coming days after the suspect is identified will talk about his or her increased alienation from society, or being swept up in a radical ideology. Someone knew the bomber. Someone saw them buy the materials for the bomb. Someone saw them on the train. Did any of them say anything? If so this might have had a different outcome.
Intelligence, surveillance, and limits on travel only go so far. Security measures like screening or device bans won't find everything. And we can't suspend every hate site on the internet or recruitment account on Twitter. The kind of security we are looking for begins and ends with regular people who report anything suspicious.
And even then we won't be able to stop everything. The last piece is resilience: the ability to recover from a deadly attack and keep going. It is easy to succumb to fear and anger in response to these events. But the terrorists' goal is not just to kill - it's to disrupt and cause panic. To stop the wheels of commerce and make people not want to leave their homes. If we let them do that to us, then they've succeeded. They will keep on doing it because it works.
The last thing they want to see is for us to reopen the arena and have a concert the very next night. We should pay respects to the men, women and children who were killed in this attack, but the best way to honor them is to take away any possible benefit to the perpetrators.