A PaaS customer receives two security findings: one in the managed language runtime that the platform provides, and one in a library that the customer's developers bundled into their own application code. How is responsibility for fixing each finding divided?
Select an answer to reveal the explanation.
Short Explanation
In a rented commercial kitchen, the owner fixes the ovens, but you're on the hook for the ingredients you bring in. In PaaS the provider patches the runtime and you patch what's in your code, libraries included. The trap is thinking a bundled library belongs to the platform just because it runs there.
Full Explanation
Platform as a Service divides responsibility at the platform boundary. The provider manages and secures the infrastructure, operating system and managed runtime, including patching vulnerabilities in the language runtime it supplies. The customer is responsible for its application code, its configuration, its data and any third-party libraries or dependencies it packages with the application. A vulnerable library bundled by the developers is therefore the customer's to update, rebuild and redeploy. Reversing the split assigns the runtime, which the customer cannot reach or patch, to the customer, and assigns code the provider never sees to the provider. Making the customer fix both ignores that the managed runtime is under provider control; the customer can choose among supported versions but cannot patch the runtime itself. Making the provider fix both overstates PaaS: providers do not test or patch customer application code and dependencies, which remain inside the customer's responsibility. Exam caveat: when a provider deprecates a runtime version, the customer must migrate its application to a supported version, which is a shared consequence worth noting. Operational check: run software composition analysis in the build pipeline to track bundled library vulnerabilities, and subscribe to the provider's runtime security notices.