SQL Server User Security - Best Practice

Hi,

I'm setting up my first couple of applications using SQL server as a back-end and I would like some pointers on best practice in setting up user security etc.

Also, one application is based in Access whilst the other is ASP - should the users be setup in the same way or are there different considerations?

I'm testing just using the sa user so I've not investigated the options available as yet - any help appreciated.

Thanks.