What is meant by "Call Stack" in the context of an OWASP review?

Question

I am studying the OWASP Level 2 review measures and methodology. I am applying this to a software I am designing and developing now, so the goal is to write the software the proper way so that it will pass the level 2 review.

The OWASP standard is here: https://www.owasp.org/images/6/67/OWASPApplicationSecurityVerificationStandard3.0.pdf

Now there is a valuable little how-to to the guide: https://www.owasp.org/index.php/How_to_perform_a_security_architecture_review_at_Level_2

In this how-to, steps 1 and 2 are clear to me. However step 3 remains unclear:

The last step is to identify call stacks for application requests, using the block diagram from the previous step as guidance.

I know what a call stack is in the context of several program languages and environments. But I don't get the point of step 3 at all. Could somebody help me to understand, what precisely are the deliverables of step 3?

Is "call stack" here a synonym for "UML call graph"? If yes, is the task to show how a web command is handled through all the technical layers down and back again?

Answer 1

Yes.

I'm not an expert on OWASP but reading the linked guide it seems to me that they want you to:

1. Identify the components.
2. Draw the components in a layered architecture diagram
3. Show how request pass through those layers.

I can see how step 3 here would be valuable as you can see which requests require what security and see which layers those request pass through.

For example, if you had the requirement that customer data at rest should be encrypted then seeing that the credit card info of a customer hits the persistence layer would flag that you needed to encrypt that persistence layer on disk.