A security operations team is migrating a web application to a cloud provider. Under the Platform as a Service (PaaS) model they selected, the team wants to clarify which security responsibilities remain with them versus the cloud provider. Which task remains the responsibility of the customer's security operations team in a PaaS environment?