Some stuff to look at

http://www.netwitness.com//solutions/incidentresponse.aspx

http://devcentral.f5.com/weblogs/macvittie/archive/2008/11/07/virtualization-how-to-isolate-application-traffic.aspx

http://startupsecurity.info/blog/2008/11/06/typical-injection-points-in-a-web-application/

http://pauldotcom.com/2008/11/discovering-rogue-access-point.html