New York (CNN) Days after a man set off a homemade explosive in the heart of the nation's largest subway system, Mark Murphy sat reading on a New York A train and -- like others around him -- displaying no obvious worry.

"I'm not really concerned," he said, looking up from a hardcover as the train embarked on a journey of more than 31 miles from upper Manhattan to Far Rockaway in Queens. "There's only so much you can do."

Monday's rush-hour bombing beneath the streets of New York exposed the many vulnerabilities of the sprawling, round-the-clock subway system, a labyrinth of 472 stations -- most with multiple entrances -- and hundreds of miles of track that would stretch to Chicago if laid end to end. It carries about 5.7 million riders each day, the most since 1948.

The blast came at a time -- between Thanksgiving and New Year's -- when the city attracts more than five million visitors. Many take the subway to the Rockefeller Center Christmas tree, the famed store window displays on Fifth Avenue and the Winter Village at Bryant Park.

On New Year's Eve, more than 1 million people pack Times Square for the annual celebration.

"You'll see additional officers out in force," Mayor Bill de Blasio tweeted after Monday's attack. "The NYPD will secure all transit hubs and major sites in this city."

"We have almost 3,000 transit cops that work in the subway system every day," O'Neill told reporters less than two hours after the explosion. "All parts of this system are patrolled."

Still, few threats have concerned the people who run and protect the subway as much as a lone-wolf attacker walking into a busy transit hub and blowing himself up.

"In the early days after 9/11, it was one of the scenarios -- a suicide bomber or a series of them in the subway system -- that was at the top of the list of what we were concerned about," said David Kelly, a former NYPD assistant commissioner for counterterrorism who is now an associate managing director at K2 Intelligence.

"Precisely because it would be easy to do and because it could have such a tremendous impact on the city."

JUST WATCHED Witness: Dozens of ambulances in the area Replay More Videos ... MUST WATCH Witness: Dozens of ambulances in the area 01:58

Difficult, if not impossible, threat to detect

On Monday, a 27-year-old Bangladeshi man named Akayed Ullah allegedly detonated a "low-tech" device that he attached to himself with Velcro and zip ties. It was made of a battery, wires, metal screws and a Christmas tree lightbulb.

Marlyn Yu Sherlock was at a store on the main floor of the Port Authority Bus Terminal when panicked commuters began flooding out of the smoke-choked subway station. Christmas carols blared amid the mayhem, she said.

The explosion occurred about 7:20 a.m. in an underground walkway connecting two subway lines beneath the bus terminal near Times Square, which accommodates 220,000 passenger trips a day.

"What we're seeing is simpler attacks, individual attackers either inspired or possibly directed and turning commonplace items into weapons," said Henry Willis, associate director of the Homeland Security Operational Analysis Center at the RAND Corporation.

"This particular threat is one that is very difficult, if not impossible, to detect before the attack, and the targets too numerous to secure."

Ullah, who told investigators he built and detonated the bomb, said he was inspired by ISIS. Five people were treated for minor injuries. The suspect was said to be seriously injured.

"When you hear about a bomb in the subway station, which is in many ways one of our worst nightmares, the reality turns out better than the initial expectation and fear," New York Gov. Andrew Cuomo said.

JUST WATCHED Video shows subway explosion Replay More Videos ... MUST WATCH Video shows subway explosion 01:02

A pro-ISIS group last month released a propaganda poster depicting a Christmas attack on the Vatican, according to the SITE Intelligence Group.

The terrorist group is well known for high-profile holiday attacks in Europe.

In New York, authorities said they have been on high alert since before Monday's attack, especially at transit hubs.

"Our lives revolve around the subway," de Blasio said.

"The choice of New York is always for a reason, because we are a beacon to the world. And we actually show that a society of many faiths and many backgrounds can work. ... The terrorists want to undermine that. They yearn to attack New York City."

JUST WATCHED Pro-ISIS group threatens the Vatican Replay More Videos ... MUST WATCH Pro-ISIS group threatens the Vatican 02:27

The NYPD told CNN in a statement on Saturday that extra precautions were being taken during the holiday season.

"The NYPD normally increases the security presence in the areas of Times Square and Rockefeller Center, as well as other locations where there is an increase of activity, during the holiday season," the police department said.

"In light of the recent terror incident in Times Square there will be additional high-visibility patrol coverage in the area. Other enhanced security measures will be implemented as well."

First subway bombing in 23 years

This week's blast was the first bombing on the subway since a man in 1994 set off a pair of homemade gasoline devices on Manhattan trains.

Since terrorists downed the twin towers on September 11, 2001, a small army of NYPD officers on the trains have been aided by a network of hundreds of security cameras on stations and platforms. In addition, heavily armed counterterrorism teams and officers with bomb-sniffing dogs and portable radiation detectors are routinely deployed underground. Random bag searches are conducted at stations.

"We should not underestimate the vulnerability of transit systems, because people expect them to be open," said Anastasia Loukaitou-Sideris, a professor at the UCLA department of urban planning. "Thankfully, these are exceptional instances when you think about the millions of trips that people are doing every day."

Mike O'Neil, a former commanding officer of the police department's counterterrorism division, said the sheer size and openness of the transit system pose serious security challenges.

"You need to engage the public and not scare them but empower them with information about the threat and make them partners in this," said O'Neil, who's now the chief executive of MSA Security.

Since 9/11, part of the city's strategy against terrorism in the transit system has involved suspicious package alerts and the "If you see something, say something" campaign, which urges riders to report suspicious behavior underground.

"We can't say it enough times: When you see something, say something," Mayor Bill de Blasio said this week.

"This is the difference maker. We've seen it time and again. When an everyday New Yorker sees something that doesn't make sense, hears something, sees a package, gets a feeling that something's wrong. Don't hold it yourself, tell a police officer."

JUST WATCHED Governor: Attack suspect was influenced online Replay More Videos ... MUST WATCH Governor: Attack suspect was influenced online 01:19

Other terrorist plots thwarted

On Monday, Metropolitan Transportation Authority Chairman Joe Lhota told reporters the agency held a "tabletop exercise" with the NYPD last month "to coordinate our efforts" in the event of a subway bombing.

"The result of that was ... in less than two hours we are back totally up to speed and getting our passengers around," he said.

O'Neil said keeping the trains moving and reassuring the public is important.

"You don't want to disrupt the way of life," he said. "If you shut the whole transportation system in New York City you're creating more of a potential target."

Attempts to attack the New York subway have been prevented mostly through intelligence gathering and investigation, officials said.

In 2012, for instance, a Bosnian immigrant accused of plotting to bomb New York's subway system as an "al Qaeda terrorist" was found guilty of conspiracy to use weapons of mass destruction, conspiracy to commit murder, supporting a foreign terrorist organization and other charges.

Prosecutors said Adis Medunjanin traveled to Pakistan's tribal region with two high school friends, Pakistani-born Najibullah Zazi and Zarein Ahmedzay, an immigrant from Afghanistan. His friends pleaded guilty to planning the attack with Medunjanin and testified against him.

John Miller, NYPD deputy commissioner for intelligence and counterterrorism, said local, state and federal law enforcement agencies have thwarted more than two dozen terrorist plots in New York since 9/11.

"We have prevented ... a significant number of attacks," he said. "But this is a fact of life. Whether you're in New York or London or Paris. The question is, Can it happen here? And the answer is, it can happen anywhere."