Multihoming is having a connection to two different network connections at the same time. Such as two network cards. However, the security problems extend to more than just that, such as you described with additional virtual network connections being tunneled over the single physical connection.
Network security professionals to take these sorts of configurations seriously, as it increases the attack surface of the network they're trying to defend. When you bridge a workstation between the corporate intranet and the public internet (via something like a ClearWire modem), it does indeed bypass all the corporate protections and your machine is the only thing standing between the two. Therefore, the security managers have to pay attention to it.
- Is this really a massive security hole? Pretty large, yes, Though it can be mitigated if managed correctly. The key being to manage it. Rogue ClearWire modems or 3G network dongles do not qualify as 'managed' and thus incur the maximum penalty.
- How (if any) does this differ from being connected to a VPN? Is that not the same thing? If the VPN is managed by the company, there are standards they can put in place on that VPN to make sure the traffic is managed. Or if it isn't, at least be able to tell which user was responsible for the bad traffic that managed to get through. On the other hand, if the VPN is one you're running to your home network somehow, that counts as 'unmanaged' and will be treated as #1. Even if your home network is firewalled six was from Sunday.
- How (if any) does this differ from being connected to a LAN and public wireless network at the same time? As far as the security manager is concerned, establishing a VPN connection to some unidentified remote part of the Internet and connecting to a public wireless network are exactly the same thing as far as risk management goes.
- How do you protect from this? It's a cat and mouse game. To prevent VPN connections outbound, Firewalls are configured to attempt to block VPN-like traffic. To prevent wireless connections, asset-inventory and network-access-control software can identify workstations with more network connections than authorized, which will trigger whatever actions are needed. Users are wiley, and will find ways around most network access controls (almost anything can be tunneled over HTTP these days), so this game is continually evolving.
The thing to keep in mind is that from a Security Manager's point of view, there is no real difference, risk-wise, between a VPN to your home network, a wireless connection to the Starbucks downstairs, or a ClearWire modem naked on the internet. Each of these have varying levels of risk, but it is impossible to truly automatically discriminate between them. Thus, each has to be treated as if the remote connection is pointed at the naked internet.