In an IaaS model, while the cloud provider manages the physical infrastructure, the customer is responsible for the administration of the virtual resources provisioned, including the operating system and applications. This includes keeping the operating system updated and patched. A misunderstanding of this responsibility could lead to security vulnerabilities, hence why it is important to know the delineation of responsibilities.