There are two levels of security that need to be changed in order to allow remote access.

SQL Server configuration. By default in Express, Developer, and Enteprise Evaluation editions, connecting by the TCP/IP protocol is disabled. Enable this using SQL Server Configuration Manager.
Windows Firewall. While disabling the firewall entirely will work for this component, doing so is not a security best-practice (nor is it required). (Note: in this section, I assume a default configuration. There are many settings that can be changed which affect these steps slightly.)

There are two cases depending on the type of SQL Server instance you're connecting to:
Default instance (connect by computer name only). Add an allow incoming rule either on TCP port 1433 or the database engine service.
Named instance (connect by computer name + instance name). Add an allow incoming rule on UDP port 1434 to access to the SQL Browser service. Add an allow incoming rule on the database engine service.
This procedure is fully documented here, or you can watch me explain and then walk through the configuration for a named instance here.