security concerns with internet connection sharing

Question

My work uses Windows only. So when I asked for a linux computer in addition to my windows computer, they said only if the linux computer is NOT connected to the company's network. So my windows and linux computers are direct connected, so:

internet ----- company network ----- windows computer ----- linux computer

And they said I CANNOT enable internet connection sharing (to allow the linux computer to access the internet through the windows computer) because that would connect the linux computer to the company network; I think they think it could be a security risk.

So my questions are:

Is it a security risk to my employer to enable internet connection sharing with my linux computer?

Would ICS really connect my linux computer to the company network? or would the linux computer only see my windows computer and the internet?

Answer 1

The short answer is yes. ICS would allow your linux computer access to the company network. It's different to a network bridge, but for your intents, not noticeably so.

ICS performs a NAT function. It allows computers connected to one network adapter to access the network on the other network adapter. Let's try to describe this with some ASCII art:

                 Computer with ICS
                +-------------------+
network A ----- | NIC A       NIC B | ------ network B
                +-------------------+

(NIC is Network Interface Controller, or network card)

The way this is generally done is like so. Your computer has an internet connection on NIC A. It might be a dial-up modem, it might be an ADSL connection. That network connection will generally only give out one IP address to NIC A. It generally won't give out any other addresses, meaning no more computers can join that network.

What ICS or NAT does is sets up another network on NIC B, using completely different addresses. It hands out IP addresses on network B and says "If you want to access anything not on network B, do it via NIC B" (it advertises itself as the default gateway). The computers on network B send their traffic to NIC B, the computer does a NAT translation and sends the data out NIC A.

So a computer on network B could certainly access computers on network A. They won't be part of the same network segment, so they won't "see" each other by default. But they do have access.