There are a couple of options, depending on how open your boss is with you.
Open the iCal preferences pane, click on accounts, then hit the '+' sign to add an account, provide the email address and password for boss' account. Depending on what kind of email/calendar server setup you have at work, iCal may be able to find it automatically. This requires the most trust, as your boss would be sharing his/her password.
Another option would be to set up proxy access to your boss' calendar/email at the work side, which would allow you to see those things via your own account. You could then access those via iCal using your own ID and password. Obviously this is still less than private, since you'll likely be able to see his/her email too (a lot of programs don't separate calendar from email, and use only one ID/pw combination to get both).
If those option's are not good, your boss can publish his calendar to a URL (again, depending on whether server setup allows this). If you can do this, keep the URL handy, then in iCal, go to Calendar > Subscribe... and add the URL.
I think that's right, and hopefully others will chime in to share their methods.
