A common criticism of militaries is that they are always preparing to fight the last war instead of the next. The recent attack in Norway suggests that the same problem exists for the "war" on terrorism. The point is made clearer if we compare that attack to its closest equivalent: 9/11.
The attacks have two critical characteristics in common. The first is that the form of the attack was original. The second is that it was strikingly successful, from the standpoint of its objectives—did a lot of damage at a relatively small cost to the attackers. That is not terribly surprising, since an original attack is one that potential defenders do not expect and so fail to take precautions to prevent.
With the benefit of hindsight, it was obviously imprudent, arguably suicidal, for a political party to put a large number of its younger supporters, its future elite, on a not very large island with no guards. That created a situation where a single gunman could murder about eighty victims and badly handicap the future of a major political party.
If the final point is not obvious, consider the equivalent U.S. case, scaled. The U.S. has more than sixty times the population of Norway. What would be the effect on the future of the Republican or Democratic party if more than 4000 of the most active members of the Young Republicans or Young Democrats were killed?
What was the cost of accomplishing that to the perpetrator? As far as we know, he did it all himself. The shooting spree required one rifle, one pistol, and a lot of ammunition—total cost probably under a thousand dollars. The previous explosion, part of whose purpose was presumably to set up the opportunity for the subsequent shooting, cost one car, very likely rented, a lot of ammonium nitrate and fuel oil, and some sort of detonator and timer. For a wild guess, total cost of the whole project between one and ten thousand dollars.
Plus, presumably, life imprisonment, a cost balanced by the opportunity to get wide publicity for his political views.
Which gets us back to where I started. Most of what one can see being done to prevent terrorism, most obviously the exertions of the TSA, is aimed at preventing a repeat of 9/11. It ought to be aimed at the next, and entirely different, 9/11.
Which is a much harder thing to do, since we do not know what it will be.