New Oracle Security Paper:
How to secure Oracle passwords from rainbow tables and new password cracking patches.
Also includes free audit tool called OraBrute to brute force SYS AS SYSDBA in order to check that it has been secured. Unfortunately by default it is not but can be secured by following this papers recommendations.
http://www.ngssoftware.com/research/papers/oraclepasswords.pdf