Security is 90% mental. As has been demonstrated time and again, most security is against a perceived threat rather than for creating a secure process. If the security forces guess attack trajectories A, B, C, and E, and the would-be attacker uses vector D, s/he wins.
A case in point is the security theatre to be seen at most US airports. As Robert Fisk once noted (rough paraphrase): "After 9/11, I could have my toothpaste but not my dinnerware. Now, I can have my dinnerware but not my toothpaste." Aside from harassing the general public and making a show of doing something, I would render an estimate that 75% to 90% of all airport security measures are psychological in their effect, making travellers feel safer and making the government and the airport authorities look like they are doing something.
No real threats are foiled. Rather, such measures only combat amateurs -- the same people who would have been foiled prior to 11 Sept-type measures. The current US regime touts its success by saying that no terrorists have succeeded in hijacking planes, etc. in the last five year. But, as William Blum notes, no terrorists succeed in hijacking planes, etc. in the five years prior to 11 Sept 2001 either.
With regard to the Johnson Space Center, one could naturally lock down almost every vector/trajectory for 98% security, but that would cost virtually all of your operating budget and probably make it such that people could not do their work.
Hope this helps. As Helen Keller observed: "Security does not exist in nature." It is essentially a human construct.