I'm not trying to be disrespectful of the victims of last week's attack, but let's all take a moment and recognize the fact that the attackers performed very well. These guys were good, and we need to learn lessons from this. Here's what I see:
(1) They did not rely on explosives.
Too much of our security is concentrated on detecting bombs. I believe there was one car bomb used, but most of the damage done was by gunfire, with some grenades as well. Guns are cheaper, easier to conceal, more reliable, etc. Sadly, I saw this coming.
(2) They attacked lightly defended targets.
We keep pouring more money and effort in making it harder and harder to attack airplanes.* There is no longer much point in trying to attack an airplane when you could be attacking the undefended luggage carousel at the airport, or a post office, or amusement park, or hotel, or theater, or ticket booth, or shopping mall, or bus stop, or taxi stand, or ...
(3) They attacked multiple targets at once.
Much easier to do when you do not need to build relatively complicated bombs and have your choice of thousands of lightly defended or undefended targets. Whenever something goes wrong every different police agency (which in a city like DC is upwards of a dozen**) rushes to the scene. Throw in all the fire and rescue services and you've got an uncoordinated snarl of independent agencies. Force them to respond to multiple sites accross the city and you can throw them into complete disarray. If I was planning an attack like this I'd start the day with some fires and major traffic accidents and other events that don't look like terrorism just to put emergency responders on their heels and force them to react to the "real" attack after they've already been scattered out in the field.
(4) They attacked the emergency response system itself.
In this case, a hospital. Again, this causes disruption out of proportion to the damage done.
(5) They used the initial attacks as bait to draw out more targets.
Mumbai's counter-terrorism chief and a couple of his deputies were targeted and killed when they responded to one of the scenes. This tactic was described well in Jonathan Hickman's Nightly News, in which terrorists would shoot somebody knowing that news crews would quickly arrive on the scene, at which point they would be attacked. The news crews were the real targets all along, the original victims were just bait.
If we ever did manage to secure every place where people congregate terrorists could always manufacture their own targets by (for example) staging a car crash. The nearly inevitable crowd of onlookers becomes an undefended target.
* Actually we're even worse. We only defend planes from the time they reach the gate for boarding until they land at their destination and passengers disembark. They're almost entirely undefended overnight, for instance. Many of the cleaning and catering personnel are not screened, and the planes don't even have locks on the doors to secure them when they're on the tarmac overnight. We go to extreme lengths to secure planes sometimes, and the concourses of airports, but not planes or airports in general.
** The Metropolitan Police Department [spits on floor], the Federal Protective Service, the Amtrak Police, the Metro Transit Police, the FBI Police, the US Capitol Police, the Park Police, the Secret Service, the US Mint Police, the Supreme Court Police, the US Marshall Service, the Pentagon Force Protection Agency, the Naval District of Washington Police, the DC Housing Authority Police, the Smithsonian Institution Office of Protection Services, the National Zoological Park Police (!) and various police and security forces at universities including Georgetown, AU, GWU, Howard, UDC and CUA. Venturing into the suburbs you would run into the forces of two states, half a dozen counties and uncounted municipalities, which would double the current count at least.