In this excellent Network Collective Short Take, Russ White breaks down the logic behind complex passwords. While a certain degree of complexity is needed to ward off the lowest level attackers, the real goal here is to make the barrier to guessing passwords enough for the would-be attacker to seek another target.

Russ does a good job of putting this into the context of individual user vs system security.