What do you specialize in?

　My specialty is informatics. My research interests are mainly in the area of risk management of information systems. Risk management is to identify the risks associated with the information system and to minimize the impact of the risks if they occur. Risks can be attributed to many things, including natural disasters, software bugs, hardware failures, cyber-attacks, and human error.

　Information systems are spreading and becoming more complex in society today. They are indispensable to our social life, economic activities, and educational and research activities. Appropriate risk management of information systems as social infrastructure is important for social stability. We have been mathematically formulating an integrated risk management method for multiple international standards defined by the International Organization for Standardization and developing a prototype system that embodies the method.

　We also promote research on the efficient development and operation of information systems and the analysis of data stored in information systems.

Why did you become a researcher?

　My experience in the Kingdom of Bhutan led me to work and research at a university.

　I was originally working as an engineer at a Japanese private company. After that, I was posted to the Kingdom of Bhutan with the Japan International Cooperation Agency (JICA) as a member of the Japan Overseas Cooperation Volunteers. I worked as a lecturer at the Royal University of Bhutan, where I taught programming in the class and developed a Learning Management System. In Bhutan, I experienced frequent power outages and voltage surges that made the information system unavailable and disrupted university classes and operations. Such incidents are rare in Japan. I realized the stable operation of information systems is truly important. In today's society, information systems are a part of the social infrastructure, just like electricity and water, and they are indispensable. It made me realize once again how grateful I am that such infrastructure is maintained so that it can be used every day without a second thought, and it re-affirmed the importance of maintaining and managing the infrastructure, and the efforts and hardships of the engineers who maintain it. In today's society where information systems are intrinsic to education, it is important for universities to be able to use information systems in a stable manner at all times. From my experience in Bhutan, I have come to research how to manage risks and how to operate information systems efficiently and stably.

What are some moments you enjoy as a researcher?

　When I am asked by others to publish methods and information systems that I have developed.

　I work in the information systems department of a university, and I conduct research while operating information systems. Therefore, unlike most researchers, my research is practical research closely related to the "practice" of information system operation. We feedback the knowledge gained through the operation of the information system and the knowledge gained from research to each other to conduct academic research that addresses real-world issues and to operate the information system based on advanced research. This is very important in the real world.

　When we submitted a paper to an academic journal about a risk management method and a prototype system that embodies the method, a reviewer commented, "I hope that you will publish the system you have developed so that it can be implemented in other organizations." When I am asked to publish my research results which address real-world problems in the operation of information systems. I am happy because I feel directly that my research is contributing to the real world.

Do you have a goal you are currently working towards?

　We currently have two goals.

　The first is to establish an integrated risk management methodology. The International Organization for Standardization defines the following international standards related to the information systems sector.

> Information Security Management System
https://www.iso.org/standard/54534.html

>Service Management System

https://www.iso.org/standard/70636.html

> Business Continuity Management System

https://www.iso.org/standard/75106.html

In the International Organization for Standardization's international standards, risk management is:

"Coordinated activities to direct and control an organization with regard to risk."

It is defined as an activity that is important to achieve the objectives of the organization. However, the method for integrating the risk management of the three standards has not yet been clarified, so we are aiming to establish a concrete method for integrated risk management.

　The second goal is the establishment and effective operation of Shinshu University CSIRT, which stands for Computer Security Incident Response Team, an organization whose main job is to respond to computer security incidents. In addition, during normal times, we collect information and conduct educational activities related to computer security. We aim to effectively operate the Shinshu University CSIRT for a campus life with fewer security incidents.

Could you tell us about three items such as work tools, books or souvenirs you purchased on your trip to academic meetings, etc?

?A laptop

All I need is a laptop and a network and I can work anywhere in the world. I prefer this model because it is light, and has many useful plug-in interfaces.

?International Standards Document

For educational institutions of more than 10,000 members, it is important to reduce dependency on personal skills and to standardize the operation of information systems in accordance with international standards in order to maintain security and to provide stable IT services to the entire university.

?Gho

This is a national dress for men of the Kingdom of Bhutan.

My experience in Bhutan led me to work and research at a university. For me, Bhutan is my second home. Every time I see a Gho, I remember my original intention. I do not wear this usually, but I sometimes wear a Gho when the Bhutanese royal family visits Japan.

I was fortunate enough to meet the King of Bhutan during his visit to Japan.

https://www.jica.go.jp/volunteer/outline/story/09/index.html

For more information on Assistant Professor Matsumura:

https://soar-rd.shinshu-u.ac.jp/profile/en.yecpbVAp.html