If you are responsible for the application's security but not the operating system's security, which cloud computing service model are you using?

In your own data center, you are responsible for all layers, including the application, OS, and physical security.

With Infrastructure as a Service (IaaS), the customer is responsible for securing the operating system, applications, data, and network configurations, while the provider secures the physical infrastructure.

In PaaS, the cloud provider manages the underlying infrastructure, including the operating system, servers, and networking, as well as the runtime environment. The customer is responsible for the applications deployed on the platform and the security *of* those applications, but not the OS or lower layers.

In Software as a Service (SaaS), the cloud provider manages almost all aspects of security, including the application, OS, and infrastructure, with the customer primarily responsible for data and user access.