Choosing secure passwords and implementing good password policies are by far
the most important defense for protecting against password based security threats.
Oracle recommends customers use passwords at least 10 values in length. In
addition, the complexity of the password is critical. Passwords that are based on
dictionary words are vulnerable to "Dictionary based attacks". A complex
password should contain:
• At least 10 values in length
• A mixture of letters and numbers
• Contain mixed case (Supported in Oracle Database 11g)
• Include symbols (Supported in Oracle Database 11g)
• Little or no relation to an actual word