Difference between revisions of "Summit 2011"

Revision as of 18:44, 26 November 2010

Welcome

Dear OWASP Leaders and appsec community, The Summit will be held February 8th-11th at CampoReal Resort in central Oeste Portugal, 38 km north of Lisbon and 18 km inland from the Atlantic Ocean. This will be the place where appsec experts meet, discuss, work, socialize, and set the roadmap for OWASP in coming years. The Summit Activates *You* Whereas the OWASP AppSec conferences are great places to listen to interesting talks, go for training, and meet with OWASP people, the Global Summit is the place where we all sit down together and take the time to discuss and work out plans, projects and solutions for the appsec future. Examples of topics: How should we support the OWASP projects? How can we work with browser vendors to enhance security (see "Browser Day" tab above)? How should the community reach out to developers and education institutions? How often should we publish the OWASP Top 10? How can OWASP support your chapter?

Organizing Committee Lorna Alamri, Brad Causey, Justin Clarke, Paulo Coimbra, Dinis Cruz, Martin Knobloch, Dave Wichers, John Wilander, Jason Li, Tara Causey, Sarah Baso .

Who's Invited? As an OWASP leader you are automatically invited to the summit, but we also welcome leading experts from industry and academia. Together we can create a more secure web. Check the "How Do I Join?" tab above for more info.

Operational guidelines

Following the first meeting of the Summit 2011 Organizational team, here are the current proposed operational guidelines:

1. the summit is an annual event
2. outside OWASP conference
3. the summit should take place in January not later then begin of February
4. the summit takes 3 to 4 days
5. budget aim is US$ 150'000 US$ where 50'000 from OWASP and US$100'000 from sponsors
6. attendees targets are:
   1. OWASP Funded:
      1. Board
      2. Committee Members
   2. Chapter / sponsor Funded:
      1. Chapter Leaders
   3. Project Leaders
7. venue / location criteria (no decision on the venue)
   1. 1 key organizer in close contact with the venue
   2. hosting 30 to 100 people
   3. US$2'000 a head (flight/accommodation/food/beers)
   4. conference facilities
      1. multiple meeting rooms
      2. one big meeting room e.g. auditorium
      3. hotel with the conference facilities or conference venue within walking distance
      4. apartments if possible (to share apartments/rooms and save money)
      5. 4 to 5 star hotel
      6. local food supplier for apartment crashing
      7. has to be negotiated with the hotel
      8. max 50 km's form international airport
      9. sufficient Internet access!

Success factors (what indicates the summit as success)

1. break even
2. the summits are the place to go to discus about and working on Web Application Security
3. review of the past year
4. working sessions on committees, projects and industry sectors (e.g. browsers and frameworks)
   1. universities / education sessions
   2. committee member election
   3. board election
   4. strategic OWASP issues
   5. road map and action plans for the next 12 month

Other local Summit(s):

• The conferences are free to organize small, conference bound summit
• this are not sponsored by OWASP of OWASP summit budget

XSS Eradication

We will have a half day working session on Cross Site Scripting - specifically how OWASP can make 2011 the year of XSS... going away. How we help bring this about through contributing our knowledge to cornerstone projects, how we can raise the awareness through advocacy, and what we can do to ensure that OWASP and other freely available resources and made available to the wider community, and that they are aware of them.

Enterprise Web Defense Roundtable

How are enterprises defending web applications. Discussion of best practices, effective methods, and new ideas to enhance web application defense. (Session Leader: Michael Coates, Mozilla)

University Outreach

This summit will be the place to bring OWASP Educational Supporters together! What security major and minor educations are out there? How can OWASP participate and influence their curricula? How can the relationship between Universities and OWASP be standardized? What does OWASP have to offer Universities and what can they, in turn, expect from each other?

OWASP Projects

We will have a session on how OWASP should support, grow, and manage projects. This includes:
-Assessment criteria
-Orphaned projects
-Funding
-Marketing
-Commercial services

OWASP Around the World

OWASP is a fast growing global community. How should we support and manage this growth? During this session we'll look into issues of:

• Internationalization
• The global job board
• New OWASP chapters in parts of the world where we have not spread much yet

More Topics

You know how OWASP works – it's all up to you. Please edit this tab and enter topics we should cover during the Global Summit 2011! If you want you can add your name after each suggestion and we can work out the details with you.

• Discussion on Douglas Crockford's bold statement that we should stop HTML5 development, fix XSS, and then start over. Is he right? How is OWASP active in the HTML5 development? Check this webcast, jump to 20:50 to hear the XSS part. /John Wilander
• [Your topic here]

How Do I Join? / Mailing list

As an OWASP leader you are automatically invited to the summit. Cost to attend the summit is $800 USD (shared accomedations) plus travel expenses. Please see "Applying for Chapter and Project Funding" and "Letters and Summit Materials" tabs for more information on finding funding help for expenses.

The first thing to do is to join the Summit 2011 mailing list.

On the mailing list you'll get first hand information on how to register, exact dates, updates to the agenda, funding for your trip etc.

If you are a leading appsec expert from industry or academia but not yet an OWASP leader you can just contact John.Wilander at owasp.org and we'll try to get you in.

Social Events

It goes without saying – the summit is all about meeting people. So there will be a constant mixture of workshops, dinners, beers and wine. We like to think of the summit as a very social event in itself.

Venue

Below is the link to the Venue of the 2011 OWASP Global Summit -- CampoReal Resort. CampoReal is located in central Oeste Portugal 38 km north of Lisbon and 18 km inland from the Atlantic Ocean.

http://www.camporeal.pt/en/hotel-residences.aspx

Download a PDF factsheet about CampoReal Resort

The hotel has an Airport Shuttle, Gym and Fitness Center, Gootball camp, Horse Back Riding, Day Spa, Internet WiFi, and Golfcourse as well as many other amenities.

Meals and coffee breaks will be provided by OWASP.

Villa Accomadations:

Residence-Pool 3 or 4 bedrooms
- Villa

Each Residence includes:
- Private bathroom(s)
- Kitchenette
- Balcony or garden
- Swimming-pool shared by apartment/townhouse block
- Residence-Pool for 3 bedroom and 4 bedroom villas include a private swimming-pool

A Day in Lisbon, Portugal:

Click this link to see all the City of Lisbon has to offer, which is only a short train ride from the resort.
http://www.golisbon.com/portugal/cities/cascais.html
or
http://www.travel-in-portugal.com/Cascais/
Lisbon - Spreading out along the right bank of the Tagus, its downtown, the Baixa, is located in the 18th-century area around Rossio. East of the arcade Praça do Comércio, are the medieval quarters of Alfama and Mouraria, crowned by the magnificent St. George's Castle. To the west lie Bairro Alto and Madragoa, with their typical streets, and on the western extreme is Belém, with its Belém Tower, (the sentinel over the Tagus river that protects the entrance into Lisbon), the Jerónimos Monastery (masterpieces of Manueline architecture and classified in UNESCO's International Heritage list) and the Cultural Center of Belém.
Museums: Ancient Art, Chiado (Contemporary Art), Tile, Archaeology, Ethnology, Coach, Costume, Theater, Maritime, Military, City, Gulbenkian, Modern Art Center, and the Ricardo Espirito Santo Silva Foundation. Palaces open to the public: Ajuda and Fronteira. Churches: Cathedral (with Treasury); São Vicente de Fora; Conceição Velha (Manueline), São Roque and Sacred Art; Madre Deus; Santa Engrácia Pantheon (Baroque), and the Estrela Basilica.
Shopping: Downtown; Avenida de Roma, Praça de Londres, Avenida Guerra Junqueiro, and Amoreiras.
Nightlife: Bairro Alto and Avenida 24 de Julho.
Guided Tours

Sponsoring

We will welcome a few sponsors of this very special event, typically organization that participate in the summit. If you are interested in supporting the global summit, please contact Lorna.Alamri at owasp.org.

Attendees that qualify to be sponsored by OWASP
Some leaders that are active within OWASP may qualify to have all or partial transportation and lodging paid for by OWASP.
To be considered for qualification, you must meet one or more of the following criteria:

1. Member of the OWASP Board
2. Active member of a Global Committee (as determined by the OWASP Board)
3. Operational personnel that are necessary for the operation of the Summit

Current sponsorship budget is $50,000 for the Summit.

If you feel you might qualify, please contact Brad Causey or Jason Li. If you do not meet these criteria, and still feel that you should be sponsored, please contact Brad Causey @ or Jason Li @

Applying for Chapter or Project Sponsorship

Application for OWASP Chapter or Project Funding

Confirmed Summit Attendees

CONFIRMED 2011 OWASP GLOBAL SUMMIT ATTENDEES

Confirmed Summit Attendees: with Funding

2011 OWASP Global Summit Attendees
	Name	Company	Reason for Summit Participation Working Group Interest	Summit Time Paid By	Summit Expenses Paid By	Reason for Sponsorship
view edit	Dinis Cruz @			Self		OWASP Board Member, Summit Organizing Team
view edit	Lorna Alamri @			Self		Summit Organizing Team
view edit	Tom Brennan @	OWASP				OWASP Board Member
view edit	Larry Casey @	Aspect Security				OWASP Staff
view edit	Brad Causey @					Summit Organizing Team
view edit	Justin Clarke @	Gotham Digital Science				Summit Organizing Team
view edit	Paulo Coimbra @	OWASP				OWASP Staff, Summit Organizing Team
view edit	Seba Deleersnyder @	SAIT Zenitel				OWASP Board Member
view edit	Kate Hartmann @	OWASP				OWASP Employee
view edit	Eoin Keary @	Ernst & Young		Ernst & Young		OWASP Board Member
view edit	Martin Knobloch @	PervaSec		PervaSec		Summit Organizing Team
view edit	Jason Li @	Aspect Security				Summit Organizing Team
view edit	Matt Tesauro @	Praetorian				OWASP Board Member
view edit	Dave Wichers @	Aspect Security				OWASP Board Member
view edit	John Wilander @	Omegapoint	Browser Security Working Group Global Conferences Committee Working Session	Self		Summit Organizing Team
view edit	Jeff Williams @	Aspect Security				OWASP Board Member
view edit	Sandra Paiva @	OWASP				Working Session Editor - Summit Staff
view edit	Heiko Richler @	Georg Simon Ohm University of Applied Sciences	OWASP Universities
view edit	Elke Roth-Mandutz @	Georg Simon Ohm University of Applied Sciences	OWASP Universities
view edit	Mario Heiderich @	Researcher, Ruhr University Bochum / NDS	XSS / Browser sessions
view edit	Colin Watson @	Watson Hall Ltd			London Local Chapter	Active Committee Member, Local Chapter Funds
view edit	David Lindsay @	Cigital	XSS Sessions Browser Security Sessions
view edit	Dan Cornell @	CTO Denim Group				Active Committee Member
view edit	Doug Wilson @	Mandiant			Washington DC Local Chapter	Local Chapter Funds
view edit	Jim Manico @			Self		OWASP Podcast/ranking system
view edit	Michael Coates @	Mozilla
view edit	Chris Lyon	Mozilla
view edit	Lucas Adamski	Mozilla
view edit	Justin Fitzhugh	Mozilla
view edit	Brandon Sterne	Mozilla
view edit	Chris Hofmann	Mozilla
view edit	Achim Hoffmann @	sic[!]sec	Protecting Against CSRF Overhauling the OWASP Website			ranking system
view edit	Ralf Reinhardt @	sic[!]sec	Metrics Mobile Security Industry			ranking system
view edit	Mark Bristow @	Securicon LLC				Active Committee Member
view edit	Lucas Ferreira @	Brazilian Chamber of Deputies (Câmara dos Deputados)	Global Conferences Committee Working Session	Brazilian Chamber of Deputies (Câmara dos Deputados)		Active Committee Member
view edit	Gareth Heyes		XSS Sessions Browser Security Sessions
view edit	Chris Wysopal @	Veracode	XSS Track Metrics Track Browser security track
view edit	Chris Eng @	Veracode	XSS Track Metrics Track Browser security track
view edit	Isaac Dawson @	Veracode	Browser security sessions “Web Browser Testing System” at SyScan 2010
view edit	Daniel Ng @	C-PISA/PolyU	PhD research in Security/Forensics	3rd party/own	3rd party/own
view edit	Kuai Hinojosa @	Cigital				Active Committee Member
view edit	Bart De Win	Ascure			OWASP Belgium Chapter
view edit	Mathias Rohr @	SEC Consult
view edit	Christian Martorella @	Verizon Business	Owasp training Metrics
view edit	David Campbell @	Electric Alchemy	Co-lead Mobile Security Project working session Act as GIC liason to Mobile Security Project	Electric Alchemy	Denver Chapter	Chapter leader, GIC member, Mobile Security project member
view edit	Jasvir Nagra	Google	Browser Security
view edit	Neil Matatall @	FishNet Security		FishNet Security	Orange County Chapter
view edit	Nishi Kumar @	FIS	OWASP Global Education Committee			Active Committee Member
view edit	Eduardo Vela		XSS Sessions Browser Security Sessions
view edit	Joe Bernik @					Active Committee Member
view edit	Rex Booth @	Grant Thornton				Active Committee Member
view edit	Ivan Buetler @	Compass Security	OWASP TOP 10 Training in Hacking-Lab		OWASP Top 10
view edit	Vehbi Tasar	(ISC)2®
view edit	David Ross	Microsoft
view edit	Tony UcedaVelez	VerSprite
view edit	Justin Schuh	Google	Browser Security/Sandboxing/Plugin Security
view edit	Mandeep Khera @	Cenzic	Participation in committee discussion		SF Bay Area Chapter	SF Bay Area Local Funds
view edit	L. Gustavo C. Barbato @	Dell		Dell	Belgium Chapter Ireland Chapter L.A. Chapter	Chapter Leader, Global Chapter Committee Member
view edit	Tom Neaves @	Verizon Business	OWASP Mobile Security Project OWASP Testing Guide
view edit	Keith Turpin @					Praetorian Corporate OWASP Sponsorship
view edit	Paolo Perego @		Kickstarting Owasp ESAPI for Ruby with live session coding Participating to Owasp Code Review Guide working sessions		Italian Chapter	Local OWASP Funds
view edit	Matteo Meucci @	Minded Security	Presenting the future of the OWASP Testing Guide Presenting the OWASP Common vulnerability list wiht Eoin and Anurag		Italian Chapter	Local OWASP Funds
view edit	Giorgio Fedon @	Minded Security S.r.l.	Custom Owasp .NET rulesets, FX Cop and 02, Antimalware Release Owasp Testing Guide		Italian Chapter	Local OWASP funds
view edit	Stefano Di Paola @	Minded Security	XSS Sessions Browser Security Sessions
view edit	Stephen Schwartz					Local OWASP Funds
view edit	Ralph Durkee @	Durkee Consulting		Self		Ranking system
view edit	Cecil Su @	Grant Thornton				ranking system
view edit	Juan Carlos Calderon @	Softtek	OWASP Summit 2011 University Education Training Track OWASP Secure Coding Workshop			ranking system
view edit	Helen Gao @	TIBCO Software Inc.	Membership and sponsor growth in the greater China and Asia area. The First OWASP China. OWASP Chinese project Long Island chapter growth.			ranking system
view edit	Pavol Luptak @	Nethemba s.r.o.	Improving and working on new OWASP Testing Guide v4			Ranking System
view edit	Ryan Barnett @	Trustwave	WAF Mitigations for XSS Virtual Patching Best Practices AppSensor Detection Points			Ranking system
view edit	Ofer Maor @	Hacktics	Assigning Business Risks to Applications Counting and Scoring Application Security Defects Translating Technical Risks to Monetary Risks	Hacktics		Ranking System
view edit	John Steven @	Cigital				Ranking System
view edit	Robert Hansen					Ranking System
view edit	Matthew Chalmers @		Global Committees Track OWASP Track OWASP Governance Track	Self		Ranking System
view edit	Jeff Hodges @	PayPal	Browser Security sessions Browser XSS sessions
view edit	Ryan McGeehan	Facebook	Browser Security Working Group
view edit	Collin Greene	Facebook	Browser Security Working Group
view edit	Jerry Hoff @			self	self	ranking system
view edit	Rajeev Angal	Oracle
view edit	Sarah Baso @			Self		Summit Team
view edit	Linda Potjes					Summit assistance
view edit	Tobias Gondrom @	IETF	Browser Security		Global Industry Committee	Selected by GIC
view edit	Steven van der Baan @		OWASP Global Conference Committee and usage of the CTF. O2 platform		Minneapolis/St. Paul Chapter	MSP Local Chapter Funds
view edit	Fred Donovan @	Attack Logic	XSS and the Frameworks Protecting information Stored Client-Side Development Guide OWASP common vulnerability list	self/employer	self/employer
view edit	Andreas Falkenberg	Ruhr University Bochum, Germany		self/3rd party	self/3rd party
view edit	Ferdinand Vroom @	Nationale- Nederlanden	OWASP Global Committees Metrics OWASP Secure Coding Workshop	Self	Summit Sponsorship Fund & Netherlands Chapter	Local Chapter Funds and Ranking System
view edit	Mateo Martinez @	Tata Consultancy Services	OWASP in Latinamerica integration AppSec Latam 2011/2012			Ranking system
view edit	Mike Zusman @	Intrepidus Group	Lead Mobile Security working session	Intrepidus Group	Summit Sponsorship & NY/NJ Chapter	Local Chapter Funds & Ranking system
view edit	Anurag Agarwal @	MyAppSecurity			Summit Sponsorship & NY/NY Chapter	Local Chapter Funds & Ranking system
view edit	Konstantinos Papapanagiotou @	Syntax IT Inc.	OWASP Universities OWASP and OWASP Governance Secure Coding Workshop			Ranking system
view edit	Chris Schmidt @	Aspect Security	Secure Coding Workshops Browser Security: XSS and the Frameworks Individual Projects: ESAPI OE Browser Security			Ranking system
view edit	Vasileios Vlachos @	Technological Educational Institute of Larissa, Greece	OWASP Universities	Technological Educational Institute of Larissa, Greece		Ranking system
view edit	Carlos Serrao @	ISCTE-IUL	University Outreach, Education and Training OWASP OWASP Secure Coding Workshop	ISCTE-IUL		Ranking System
view edit	Wagner Elias @	Conviso Application Security	Secure Coding Workshop Track O2 Platform	Conviso Application Security		Ranking System
view edit	Ian Fette	Google
view edit	Vicente Aguilera Diaz @	Internet Security Auditors	OWASP Training OWASP Chapters Browser Security University Outreach			Ranking System
view edit	Arian Evans				Jim Manico	Industry Thought Leader
view edit	Juan Jose Rider Jimenez @	WUL4 (What You Look For)
view edit	Abraham Kang		XSS Eradication Working Group OWASP Secure Coding Workshop OWASP Guide Working Session		SF Bay Area Chapter	SF Bay Area Local Funds
view edit	Fredrick Donovan	Attack Logic		Attack Logic	Attack Logic
view edit	Alexis Fitzgerald		Threat Modeling Privacy - Personal Data/PII, Legislation and OWASP ASVS Project Industry Development Guide	www.alexisfitzg.com	www.alexisfitzg.com
view edit	Justin Searle	InGuardians			Global Industry Committee	Selected by GIC
view edit	Kyprianos Vasilopoulos				Global Industry Committee
view edit	Steven Cheng	Amorize
view edit	Mark Thomas	Springsource - a division of vmware
view edit	Antonio Fontes @	L7 Sécurité
view edit	Luis Vilares Da Silva	OPCW		self/3rd party	self/3rd party
view edit	Vlatko Kosturjak @		Chapters Projects What is an OWASP Leader? OWASP Testing Guide Should OWASP work directly with PCI-DSS?			Ranking System (3)
view edit	Talal AlBasha @	alremh	OWASP & AML	Self
view edit	Gandhi Aryavalli @	McAfee	To participate OWASP			Ranking System (3)
view edit	Vishal Garg @	AppSecure Labs	OWASP Guide Working Session	AppSecure Labs		Ranking System (3)
view edit	Mohd Fazli Azran @					Chapter Leader Ranking System (3)
view edit	Jeremy Long @		XSS Eradication Working Group Secure Coding Workshop			Ranking system (3)
view edit	Zaki Akhmad @					Ranking system (3)
view edit	Daniel Brzozowski @		OWASP Training OWASP Secure Coding Workshop Track O2 Platform OWASP WebScarab NG OWASP .NET Project			Ranking System (3)
view edit	Alexandre Augustini	Brazil Academy - PUC RS
view edit	Sherif Koussa @	Software Secured	Only representative from Canada. Ottawa Chapter Leader, Mobile Security Project			Ranking System (3)
view edit	Jeff Ichnowski @		OWASP OWASP Individual Projects XSS Eradication (JXT)
view edit	Anastasios Stasinopoulos					Paid Student Staff
view edit	Rajeev Angal	Oracle
view edit	Alexandre Aniceto	Willway, S.A.
view edit	Rodrigo Assad	C.E.S.A.R - Centro de Estudos e Sistemas Avançados do Recife
view edit	Mattias Bergling
view edit	Deb Brewer	LXstudios				Summit Staff - Event Organizer
view edit	Bil Corry	Paypal
view edit	Sarah Cruz					Summit Graphical Designer and Event Support
view edit	Wojciech Dworakowski	SecuRing
view edit	Felipe Ferraz	C.E.S.A.R - Centro de Estudos e Sistemas Avançados do Recife
view edit	Mauro Flores
view edit	Julio Cesar Fort					Summit - Student Support Staff
view edit	Pedro Fortuna @	AuditMark	Browser Security Sessions XSS Sessions
view edit	Leandro Gomes	SERPRO
view edit	Giles Hogben
view edit	Ricardo Melo @	DRI
view edit	Tiago Mendo	SAPO				Summit Video Support
view edit	Nuno Loureiro	SAPO				Summit Video Support
view edit	Marta Pergorelli	Anggulo				Summit Support Team
view edit	Rogerio Lauritao	SAPO				Summit Video Support
view edit	Tanya Secker	Trustwave
view edit	Anastasios Stasinopoulos					Summit - Student Support Team
view edit	Jason Taylor	Secure Innovation		Secure Innovation
view edit	Benjamin Tomhave	Gemini Security Solutions
view edit	Peleus Uhley	Adobe Systems, Inc.
view edit	David Weston	Microsoft
view edit	Stefan Wuensch	Hacker Network News				Summit Video Support & PR
view edit	John Yeo	Trustwave
view edit	Pedro Campos Galvão @
view edit	Marinus Kuivenhoven @		University Outreach, Education and Training OWASP Secure Coding Workshop
view edit	Massimo Biagiotti @	Business-e
view edit	Lucilla Mancini @	Business-e
view edit	Edward Bonver @	Symantec	Threat Modeling Security Testing University Outreach		Los Angeles Chapter	Local OWASP Funds
view edit	Mikko Saario @	Nokia
view edit	Mike Samuel @	Google, Inc.	Browser Security XSS eradication
view edit
view edit
view edit
view edit

Confirmed Summit Attendees: Seeking Funds/Sponsorship

Unconfirmed Summit Attendees

Letters and Summit Materials

Summit 2011 Presentation for AppSec DC
Application for OWASP Chapter or Project Funding
Confirmed 2011 OWASP Global Summit Attendees

Template Letter - 2011 Global Summit Basic Invitation
Template Letter - 2011 Global Summit University Outreach Invitation
Template Letter - 2011 Global Summit Government Invitation
Template Letter - 2011 Global Summit Request for Employer Funding and Sponsorship
Template Letter - 2011 Global Summit Request for Employer Funding, Version 2

Schedule

* Browser Day: One of the great challenges of application security is browser security. The browser is becoming our de facto runtime platform for applications and it comprises a whole ecosystem of plugins and web technologies.Therefore we will spend a full day working together with the leading browser vendors to penetrate current problems, new ideas, and how security fits in alongside other requirements from developers and endusers.Do not miss this chance to influence what's important in browser security in the coming years.

* Sandboxing: Is sandboxing the right way forward? Can sandboxing be harmonized with the origin policies for cookies, scripting, and ajax – i e share the same compartmentalization? How should we apply sandboxing to plugins?
* Securing plugins: Should browsers ship with default plugins? Should plugins be auto-updated? Can plugins or versions of plugins be blacklisted centrally?
* Enduser warnings: How should browsers signal invalid SSL certs to the enduser? Are we helping security right now? What to do about 50 % of users clicking through warnings?
* Blacklisting: Can we cooperate better on blacklisting? Does it work between cultures, i e can we have the same process for reporting throughout the world?
* OS integration: More and more features in browsers get integrated with the underlying operating system. Processes, fonts, filesystem, 3D graphics. How do we secure this?
* JavaScript: How do we secure the universally deployed web application language? Much focus has been on execution performance but what about security? Will EcmaScript 5 strict-mode be supported anytime soon (currently no support)? Are (more) secure "dialects" such as FBJS and Caja the way to go? What's happening in EcmaScript Harmony?
* New HTTP headers: Are new opt-in HTTP headers the right way to add security features? For example Strict Transport Security, x-frame-options, origin and Content Security Policy.