A company migrated its application servers to virtual machines in a public IaaS offering. A vulnerability scan reveals that the guest operating systems are missing months of security patches because the administrators assumed the provider applies them. Under the shared responsibility model, who is responsible for patching these guest operating systems?

The shared responsibility model divides security duties between a cloud provider and its customer according to the service model. In infrastructure as a service, the provider secures the physical facilities, hardware, network fabric, and virtualization layer, while the customer is responsible for everything deployed on top: the guest operating system, its patches and hardening, applications, data, identity configuration, and network rules such as security groups. Missing guest patches are therefore a customer gap. Claiming the provider maintains the operating system describes platform or software as a service, where the provider manages more of the stack; in IaaS the customer controls the guest and the provider typically has no access inside it. The hypervisor vendor supplies virtualization software, but guest operating system updates come from the operating system vendor and are applied inside the guest by whoever administers it. Tying responsibility to physical ownership is incorrect, because the model assigns duties by layer of control rather than by who owns the hardware. Exam caveat: responsibility shifts toward the provider as you move from IaaS to PaaS to SaaS, but data and access management always remain with the customer. Operational check: document responsibilities in a matrix for each service, enroll the guest operating systems in the patch management process, and scan them on a regular schedule.