Lexical obfuscation is a software development technique that involves changing the names of variables, functions, classes, or other identifiers in the source code to make them obscure or meaningless, such as using random letters or numbers. Lexical obfuscation is often used to protect the intellectual property of the software, or to prevent reverse engineering or tampering by attackers. However, lexical obfuscation is discouraged by many organizations because it can cause problems recovering systems after disaster. Lexical obfuscation can make the source code unreadable and incomprehensible, which can hamper the debugging, testing, maintenance, and documentation of the software. Lexical obfuscation can also make the recovery of the software more difficult and time-consuming, especially if the original names of the identifiers are lost or unavailable.

Threat modeling is a practice that provides the development team with a definition of security and identification of threats in designing software. Threat modeling is a process of analyzing the software system or application from the perspective of an attacker, and identifying the potential threats, vulnerabilities, and risks that may affect the security of the software system or application. Threat modeling can help to improve the security awareness and mindset of the development team, as well as to guide the security design and implementation decisions of the software system or application. Penetration testing, stakeholder review, or requirements review are not the best practices to provide the development team with a definition of security and identification of threats in designing software, as they are more related to the testing, evaluation, or specification aspects of software development.

The Encapsulating Security Payload (ESP) provides integrity and confidentiality for network communications. ESP is a protocol that is part of the IPsec suite, which is a set of protocols and standards that provide security for Internet Protocol (IP) communications. ESP encrypts the payload of an IP packet, which is the data portion of the packet, to provide confidentiality. ESP also adds a trailer and an authentication data field to the packet, to provide integrity. ESP does not provide authorization or availability for network communications. Authorization is the process of granting or denying access to resources based on the identity or role of the requester.
Availability is the property of ensuring that resources are accessible and usable by authorized parties when needed. ESP does not perform authorization or availability functions, but it may support or complement them.

A secure card reader is a physical security control that protects ATM from skimming, which is a type of fraud where a device is attached to the card slot of an ATM to capture the data from the magnetic stripe of the card. A secure card reader can prevent skimming by encrypting the data at the point of entry, making it unreadable by the skimming device. Anti-tampering, RF scanner, and IPS are not physical security controls that protect ATM from skimming, as they do not prevent the capture of the card data by the skimming device.

A site-to-site VPN is a type of VPN that connects two or more remote networks securely over an untrustworthy network, such as the Internet. A site-to-site VPN uses a VPN gateway at each site to establish an encrypted tunnel between the networks, allowing the devices at each site to access the network resources at the other site. A site-to-site VPN is the best option to provide the functionality of connecting two remote offices securely over an untrustworthy MAN and allowing each office to access network shares at the other site.