Configurare program

API Security Testing in CI/CD

• Data 10/09/2026
• Autor Costin Dumitru
• 7
• 159

Since you already work with pentesting tools like Burp Suite, Metasploit, and Nikto, think of this as extending that manual mindset into an automated, repeatable pipeline stage. The goal of CI/CD-integrated API security testing is to catch vulnerabilities like broken authorization or injection flaws on every code change, not just during periodic audits.

Testing an API before it reaches production is far cheaper than fixing it after deployment, especially for issues like Broken Object Level Authorization (BOLA) or Broken Function Level Authorization (BFLA), which are the top risks in the OWASP API Security Top 10 2023. The core idea of “shift-left” is simple: generate and lint your OpenAPI specification, run authorization and fuzzing tests automatically, scan infrastructure-as-code for misconfigurations, and fail the build when high-severity issues appear.

Given your background in penetration testing, here’s a question to get you thinking before we go further: when you manually test an API for BOLA today, what steps do you take to confirm one user can’t access another user’s data? Hold that thought, because we’re about to automate exactly that.

CI/CD API security testing generally falls into three buckets, each targeting a different class of OWASP API risks:

• Authentication and authorization tests — verifying BOLA (swap object IDs between two valid users), BFLA (replay admin-only requests with a lower-privilege token), mass assignment (attempt to modify read-only fields via POST/PATCH), and token lifecycle behavior (expired or revoked tokens must return 401, not stale cached data).

• Input and request validation tests — submitting oversized payloads, SQL/NoSQL/command injection strings, path traversal attempts, malformed JSON/XML, and checking that GraphQL endpoints enforce query complexity limits and disable introspection in production.

• Transport and configuration tests — enforcing HTTPS everywhere, validating TLS versions and cipher suites, checking security headers, testing CORS against unauthorized origins, and scanning for verbose debug output that leaks internal paths.

A practical automation pattern for BOLA/BFLA, drawn from real testing workflows, looks like this: extract every route from your OpenAPI spec to build your attack surface list, capture three token sets (admin, standard user, unauthenticated), then programmatically replay the same request while swapping tokens or object IDs between the two user accounts — if a low-privilege token or wrong user’s ID returns a 200 instead of 403/404, you’ve found a flaw.

Building the Pipeline Stage

Rather than treating a security scan as an afterthought, it should run as a pipeline job that blocks deployment on critical findings, similar to how you might already gate deployments on failed unit tests. A minimal GitHub Actions-style stage would download a scanner such as the OWASP API Security Testing Framework, point it at your API with an auth token, output results in a machine-readable format like SARIF, and upload that report to your code scanning dashboard so findings show up alongside pull requests. Tools like OWASP ZAP, Burp Suite (which you already use manually), and 42Crunch can run these scans directly against your OpenAPI/Swagger spec, meaning your existing spec becomes the test target instead of something you write test cases for by hand.

Beyond deployment-triggered scans, it’s worth scheduling separate recurring scans (weekly or monthly) against your live production API, since configuration drift — like a firewall rule change or an expired cert — can introduce vulnerabilities between deployments even without a code change. NIST’s guidance on API protection for cloud-native systems frames this as two complementary layers: static definition-time protections (defining schemas, valid value ranges, and maintaining an API inventory) and runtime protections applied to every request and response, including encryption in transit, authentication/authorization checks, and rate limiting or circuit breaking.

Prioritizing What to Automate First

If you’re setting this up from scratch, the recommended order is: start with authorization testing (BOLA, then BFLA), then authentication, then input validation and rate limiting, then configuration and API inventory checks. A condensed priority view looks like this:

Given your Rocky Linux and Kubernetes experience, you’re well positioned to containerize a scanner like ZAP or the OWASP ASTF as a pipeline job that spins up, hits a staging deployment, and tears down automatically.

To check your understanding: if a CI/CD pipeline scan finds that a standard-user token can successfully call an admin-only /users/delete endpoint, which OWASP risk category does that fall under, and what specific pipeline check would you add to catch it on every future pull request?

Hardening POS/Payment Terminal Integration Networks

• Data 10/09/2026
• Autor Costin Dumitru
• -4
• 149

A payment-terminal network is not just “a VLAN for card machines.” It is a tightly controlled path between the POS/terminal, payment gateway or acquirer, terminal-management system (TMS), and a small set of operational services. The main security objective is to prevent a compromise of a workstation, Wi-Fi network, or back-office server from reaching payment devices or affecting payment traffic. PCI guidance strongly recommends segmentation: without effective isolation, a much broader network can fall into PCI scope.

Before implementing controls, map each payment-data flow: terminal to processor, terminal to TMS, POS to payment middleware, DNS/NTP/DHCP dependencies, logging, monitoring, and vendor-support paths. An asset inventory should identify every point-of-interaction device, its model, serial number, owner, location, firmware, network identity, and support status.

Use separate zones with default-deny controls between them:

• Terminal zone: Dedicated wired switch ports or a dedicated SSID/VLAN for payment terminals only. No corporate laptops, printers, guest devices, or general POS browsing systems.

• Payment services zone: The payment gateway, payment middleware, and/or approved connector. Permit only required terminal-to-service flows.

• Management zone: A hardened TMS, monitoring system, patch repository, and a jump host. It should not be reachable directly from normal administrator workstations.

• Corporate zone: Office users, back-office systems, and standard endpoints. Treat this zone as untrusted relative to the payment environment.

• Internet/processor edge: Allow outbound connections only to documented acquirer, processor, DNS, time, certificate-status, and update destinations.

Segmentation can be physical, logical, or both, but it must stop out-of-scope systems from communicating with—or influencing—the cardholder-data environment. A useful rule is: the terminal may initiate only the precise connections needed to process a transaction and receive authorized management updates; everything else is blocked. 

Avoid broad rules such as “terminal VLAN to Internet: allow.” Replace them with allowlisted flows that have a documented business purpose:

Build policy around both network and identity. For example, a TMS server should be the only system that can manage terminals, and a named, MFA-protected administrator should be the only identity allowed to access that TMS. PCI guidance specifically calls for MFA for access into the cardholder-data environment, including remote access to terminals or terminal-management systems.

Treat the terminal as an embedded security appliance, not as a generic network device.

• Change vendor-default credentials and disable unused local, web, SSH, Telnet, Bluetooth, Wi-Fi, USB, debug, and remote-management interfaces.

• Keep vendor-supported firmware and payment applications current through a controlled, authenticated update path; unsupported terminal software is a serious operational and security risk.

• Enforce certificate validation and modern TLS for terminal-to-processor and terminal-to-TMS communications. Do not accept invalid certificates “to make connectivity work.”

• Use device certificates, mutual TLS, or equivalent strong device identity when supported; IP allowlisting alone is not enough because IP addresses can be spoofed or reassigned.

• Remove sensitive card data from POS logs, error messages, packet captures, databases, and support tickets. Prefer processor tokenization so business systems handle tokens rather than primary account numbers.

• Protect terminals from substitution and tampering: maintain a device inventory, inspect devices regularly, train staff to spot altered equipment, and investigate unexpected reboots, serial-number changes, or new network identities.

Remote vendor support is a high-risk integration path. Never expose a terminal, POS controller, or TMS directly to the public internet. Instead, require an approved remote-access gateway or VPN, MFA, a hardened jump host, time-limited approval, session recording where feasible, and centralized logs. Give vendors a narrowly scoped role: a support account should access only the specified terminal group or TMS function, not your full internal network.

If a payment processor requires a static inbound path, terminate it in a dedicated edge zone and forward only the required protocol to a purpose-built integration component. Do not make a firewall exception from the internet to the terminal VLAN.

Hardening is incomplete until it is tested. Monitor firewall-deny events, new MAC addresses, terminal certificate failures, firmware changes, repeated transaction errors, unusual outbound destinations, TMS admin logins, and configuration drift. Review whether each terminal is communicating only with its allowlisted destinations; a terminal making DNS requests to arbitrary resolvers or HTTPS connections to unfamiliar hosts deserves immediate investigation.

Run segmentation validation from a compromised-user perspective: place a test device in the corporate or guest network and verify it cannot discover, route to, scan, administer, or reach terminal-management interfaces. PCI guidance emphasizes that segmentation should be documented, tested, and maintained—not merely shown as a diagram. Re-test after switch changes, firewall changes, new terminals, processor migrations, TMS upgrades, or vendor remote-access changes.