Propensity Theory of Probability: There is a universal tendency among bachelors to be unmarried. Therefore, the probability of an unmarried bachelor is 100%.
Personal Theory of Probability: My degree of belief that there is an unmarried bachelor is 100%.
Intersubjective Theory of Probability: Our degree of belief that there is an unmarried bachelor is 100%.
Why These Theories Matter to ISRA
Why does this philosophical distinction between objective and subjective theories of probability matter to security specialists?
(1) The theories provide much-needed clarification of the meaning of “probability.” At risk of stating the obvious, one reason these distinctions matter is because they get at the heart of what we mean by “probability.” For example, consider a system administrator who has not applied the latest security patches to his servers as quickly as the security engineer would like. Let Pr(C | ~P) represent the probability of system compromise, conditional upon not having applied the patches. The system administrator’s estimate of Pr(C | ~P) may well be lower than the security engineer’s estimate. According to the personal theory of probability, each individual is simply measuring their individual degree of belief in C conditional upon not P. Thus, the two individuals do not strictly disagree with each other.
If this seems counterintuitive, imagine two people talking about their favorite flavor of ice cream. Suppose that both of them use a personal theory of preference to describe their favorite flavor. The first person says that chocolate is their favorite flavor, while the second person prefers vanilla. The statement, “I, person A, prefer chocolate,” and the statement, “I, person B, prefer vanilla,” do not contradict each other. According to the personal theory of preference, there could only be a disagreement if the first said, “I, person A, prefer chocolate,” and then the second person, “No, person A, you prefer vanilla.”