A software team deploys their application on a Platform as a Service (PaaS) offering. The cloud provider manages the operating system, runtime, and underlying infrastructure. During a security review, the team asks which security task remains their responsibility under the shared responsibility model. Which task is the customer responsible for?