Ambient Internet-of-Things (AIoT) form a new class of emerging technology that promises to deliver pervasive wireless connectivity to previously disconnected devices and products, assisting dependent industries (for example, supply chain, clothing, remote surveillance, climate monitoring, and sensors) to obtain granular real-time service visibility. Such ultra-low complexity and power consumption devices, that are either battery-less or have the capability for limited energy storage, can provide data feeds about the condition of any aspect (e.g., an environment or an item) that is being monitored, enabling proactive or reactive control by any application server. Although the security of data involving AIoT devices is critical for key decisions of any dependent operational system, the implementation of resource intensive cryptographic algorithms and other security mechanisms becomes nearly infeasible, or very challenging, due to the device energy and computational limitations. In this article, we present a lightweight security solution that enables confidentiality, integrity, and privacy protection in wireless links including AIoT. We consider, as a case study, an ambient-powered Reconfigurable Intelligent Surface (RIS) that harvests energy from its incident radio waves to realize programmable reflective beamforming, enabling the communication between a Base Station (BS) and end-user terminals. The proposed lightweight security solution is applied to the control channel between the BS and the RIS controller which is responsible for the metasurface's dynamic management and phase configuration optimization.