In the U.S. here's how it works (I'm writing this from the perspective of a contractor):
You are hired to work on a government contract, that contract requires you to work on xyz project that requires you to handle information classified at a certain level (or with certain caveats or handling requirements). You fill out a bunch of paperwork (http://en.wikipedia.org/wiki/E-qip) and it's submitted to the government. The information you put down isn't really a whole lot more interesting than what you might put down on a home loan application, but you sign some consent forms that the investigator can do some credit checks, that sort of thing. You also put down some references they can contact.
Depending on the level you are applying for, the investigation may take longer, particularly if they interview your references. The interview questions are usually simple things like, "did you work with so and so at such and such place?" "have you ever heard them talk about overthrowing the government?" that sort of thing.
If you're a normal person, no serious prison record, drug addiction, serious mental health problem, or threatening political viewpoints (card carrying member of the nuke the US party) there's really not a lot that can prevent you from getting a clearance. Even prior drug use doesn't necessarily prevent you from getting one.
A Secret clearance has a very low bar to entry. You can get one after application in perhaps 3-6 weeks. I can't even get a cable guy to come to my house in that length of time.
A Top Secret clearance takes a bit longer, and is slightly more involved, but it's on the order of months to a year.
http://en.wikipedia.org/wiki/Security_clearance
Most of the time people either get a Secret clearance of a Top Secret clearance -- there is no such thing as a "clearance" above Top Secret but people can often be confused by special accesses at those levels (explained below).
Operating at the Secret level, you'll have access to most of the information that is classified at that level. If you've read any of the wikileaks State Department stuff or the Afghan and Iraq war diaries you've seen what kind of stuff it is. Most of the time it's just information that the government would rather not go public with, but isn't really all that interesting in nature. Records of events, meetings, general information reports, troop movements, that sort of thing.
Probably 1 in 150 Americans has at least a Secret level clearance, and probably 1 in 50-70 have had one at one time (there are a lot of people that move through the military and/or for the military).
The Military's information systems are generally geared around the Secret level of classification and done on an Internet-like network called SIPRNET, There's even a Wikipedia analog and a Google search on it. It's like using a slightly shoddy version of the Internet as it was 5-10 years ago.
http://en.wikipedia.org/wiki/SIPRNET
http://en.wikipedia.org/wiki/Intellipedia
To be honest it's not really much more interesting than using your regular run-of-the-mill corporate firewalled intranet, except it's an unusually large organization.
Not all Secret information can be shared with our allies. Why? Well, we may be fighting a war with say, New Zealand at our side, but also investigating a case of attempted bribery where NZ is trying to smuggle sheep into California or some such. We don't share the bribery investigation data for example.
To deal with this we use what are called "handling caveats". Something shareable with say Canada and Great Britain might then be marked as SECRET//REL TO USA, GBR, CAN or similar. There are also group handling codes like NATO, ISAF etc.
http://en.wikipedia.org/wiki/Classified_information_in_the_U...
http://en.wikipedia.org/wiki/International_Security_Assistan...
There are also other classification markings that are used as caveats. They look kinda the same and are called compartments. It's generally just more restrictions on who can see the information.
http://en.wikipedia.org/wiki/Sensitive_Compartmented_Informa...
People use 'SCI' like it's the same as "SECRET" or a some super high level classification. But what it really means is that it is information gathered in some way that we would really really rather keep private and thus you need another level of need-to-know to get access to it. Typically it's this way because billions of dollars was spent getting that information gathering capability and replacing it would be billions more or revealing it could expose people to severe risk, harm or death.. SCI compartments exist at all levels of classification.
Often knowing what the information is showing can directly inform somebody how it was gathered as well. So it's not just the means that's protected directly, but the data as well.
To see this information, you need to be working on a program that requires you to work with information in that compartment (need-to-know). And you will be "indoctrinated" or "read on" into that compartment. Which usually involves filling out some more forms, submitting the application, and watching a boring video telling you what the compartment is all about. There are many compartments. Compartments can also have sub-compartments.
However, in some cases, the information is so super sensitive (almost always meaning that people could be killed if it becomes known) that the government wants to make sure you can be trusted with it. So you might get polygraphed. Usually they just ask you things like "have you ever considered trying to overthrow the U.S. government" and other similar. You might also go through a slightly different polygraph with highly personal questions about your sex habits.
Even more restricted are Special Access Programs (SAPs)
http://en.wikipedia.org/wiki/Special_access_program
These are things like the Nuclear Codes. Even the names of the SAPs are super double probation classified. Often they are one super specific kind of information, and they are managed very closely by the agency that creates them. Very few people will be granted access to the SAP.
All of this holds true for Top Secret clearances and information, except everything is just that much more carefully controlled. You have to have a reason for accessing it, most people don't, and you have to fill out lots of paperwork and have lots of background investigation stuff.
You are encouraged frequently to try and accomplish as much as possible at the lowest classification possible. Mostly so we can share the information (all of which is declassified after 25 years max). But sometimes we just can't and things have to move up in classification.
Everything has a legal hurdle. There's lots of lawyers and other bureaucrats involved in everything. You have to report where you are everyday or establish where you'll be if you'll be out of contact for any length of time or you lose your job. If you did something bad while missing, then you'll probably end up in Federal prison for a very long time.
There's definitely too much stuff classified. What most people who don't know anything about the classified world complain about is this problem. It's actually reasonable to argue this. What they don't realize is it's a pain in the ass to keep stuff classified. What they also don't know is that everything declassifies after 25 years (or sooner) unless it's something super special sensitive (nuclear codes). This is a tremendous pain in the ass for the government to go through, but in the interest of stopping information that should be free from being locked away, it's done and most people I know in the field think this is great. Because keeping this stuff secret is a drag, you can't talk about most of what you do everyday at work with anybody outside of your work. You can't talk about it at home, even if your spouse is cleared.
http://en.wikipedia.org/wiki/Executive_Order_12958
http://en.wikipedia.org/wiki/Executive_Order_13526
http://en.wikipedia.org/wiki/Declassification
To put this in perspective, we're almost halfway to the point where everything about the lead up to the mistake of the Iraq War will automatically become declassified and available via FOIA requests.
All of this is done in special facilities called SCIFs
http://en.wikipedia.org/wiki/Sensitive_Compartmented_Informa...
(technically work that is not SCI protected doesn't occur in a SCIF, but that's what everybody calls them). They usually have all kinds of access controls, some have several layers.
For example (a real one), you may have to pass through a gate with an armed guard, an armed guard at a desk who checks ID, a proximity badge and keypad turnstile, a locked door with badge and keypad, an elevator with badge and keypad, a finger print scanner badge keypad combo, and then a safe to get to your hard drive, which is then protected by an encryption key, the login user/pass for the system, then a user/pass encryption key for the database you are accessing and finally a special decryption password for the file you need to download and unarchive from the database. This doesn't even include all of the signin/out logs and other paperwork required to get through a day.
Depending on your clearance, you may end up with several different computers at your desk at the same time, usually connected by a KVM of some sort. Something like this isn't all that unusual
http://upload.wikimedia.org/wikipedia/commons/6/6f/Intel_Gre...
