Who do you punish and how?
I mean, the perpetrator is already dead. Yes it was a most cowardly act, but in the scheme of things, the casualty rate was relatively low. The whole thing, however distressing for those involved, could have been far, far worse.
Short of summarily executing the entire family of those responsible, there isn't much else to be done. These people are lone nut jobs, and should be treated as such. Media blackouts/manipulation might help reduce the effect of their actions... "22 people die in a freak gas explosion at a pop concert" has far less impact than "Suicide bomber kills nearly 30 and seriously injures dozens of others..."
It sounds like the security services could be clamping down on people on their radar in a more targeted preemptive manner, but they don't seem to see individuals as threats.