I am studying the OWASP Level 2 review measures and methodology. I am applying this to a software I am designing and developing now, so the goal is to write the software the proper way so that it will pass the level 2 review.
The OWASP standard is here: https://www.owasp.org/images/6/67/OWASPApplicationSecurityVerificationStandard3.0.pdf
Now there is a valuable little how-to to the guide: https://www.owasp.org/index.php/How_to_perform_a_security_architecture_review_at_Level_2
In this how-to, steps 1 and 2 are clear to me. However step 3 remains unclear:
The last step is to identify call stacks for application requests, using the block diagram from the previous step as guidance.
I know what a call stack is in the context of several program languages and environments. But I don't get the point of step 3 at all. Could somebody help me to understand, what precisely are the deliverables of step 3?
Is "call stack" here a synonym for "UML call graph"? If yes, is the task to show how a web command is handled through all the technical layers down and back again?