Like most companies, our organization is concerned about security, and we've been setting policies to govern our SQL Server—authenticated passwords. Is it really all that important to choose a complex password that's "long enough" and that includes a mix of letter and number characters?