securing a deliberately vulnerable web app

This is a question for anyone who runs a deliberately vulnerable web
app on a public facing site to allow people to test hacking it or to
test vulnerability scanners against it. I'm thinking of things like
http://test.acunetix.com/ .

What I'd like to know is how you go about securing the box the sites
are running on. Obviously you need the site running on its own server,
preferably airgapped from the rest of your network but how do you
protect yourself from attackers getting on the box then pivoting from
it to do a real attack to someone else? I'm guessing it is something
like a VM that is automatically rolled back periodically so even if
someone tries then they only have a limited attack window but are
there any other things people do?

I'm asking because I've got an idea for a new public service which
would involve putting up an app that is vulnerable but I'd like to
make sure that if I do I protect myself as much as possible.

Robin



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------