Today's terrorist masterminds know that the main benefit of attacks on critical infrastructure is not the immediate damage they inflict, but the collateral consequences of eroding the public's trust in services on which it depends. … As long as catastrophic terrorism is assured of generating a huge bang for the buck, current and future U.S. adversaries will make it the first arrow they reach for in attacking the country.I'd suggest reading his whole essay, but the crux of it is in that quote. The point of homeland security can't be to prevent all attacks from now until eternity. That's an impossible goal. The point is to minimize the dangers and fallout as best one can and ensure that the inevitable attacks don't "require wholesale changes in how [we] go about our lives."
How much security is enough? For the foreseeable future, the threshold for success is when the American people can conclude that a future attack on U.S. soil will be an exceptional event that does not require wholesale changes in how they go about their lives. This means that they should be confident that there are adequate measures in place to confront the danger.
In other words, homeland security should strive to achieve what the aviation industry has done with safety. What sustains air travel despite the periodic horror of airplanes falling out of the sky is the extent to which the industry's long-standing and ongoing investments have convinced the public that it is safe to fly. Public confidence can never be taken for granted after a major jet crash, but private and public aviation officials start from a credible foundation built upon a cooperative effort to incorporate safety into every part of the industry….
Ongoing and credible efforts to confront risk are essential to the viability of any complex modern enterprise. Aviation safety provides helpful reference points for how to pursue security without turning the United States into a national gated community. First, it demonstrates that Americans do not expect their lives to be risk-free; they just rightfully expect that reasonable measures be in place to manage that risk. Second, managing risk works best if safeguards are integrated as an organic part of a sector's environment and if they are dynamic in adapting to changes in that environment. Third, government plays an essential role in providing incentives and disincentives for people and industry to meet minimum standards. Bluntly stated, security will not happen by itself.