Server-level security involves governing which users can gain access to any SQL Server functionality on a particular server. Object level security controls what individual users can and cannot see, and can and cannot do, in a database. In order to secure your data, you have to take both aspects on board fully at the design stage. Many live implementations of SQL Server and other databases exhibit poor or non-existent security because the subject was dealt with as an afterthought. In addition to the control on SQL Server, you must not overlook aspects such as Windows NT security, physical or remote-control access to your server, access to backup tapes, access to network infrastructure, and even to buildings.
Viruses can also be a problem.
NT viruses are rare but they do exist, and Email viruses can fill up your server's Exchange inbox if you are using SQL Mail, even if destructive payloads are not executed.