Just make your password very complex and the brute force is not much of an issue. Of course, not many people will go for that idea... Probably the best compromise is to review the advancement of password cracking technology over cost and compare that to the required complexity of a password to survive for at least 120 days without being cracked, and make your password complexity at least stronger than that. You can attempt relying on things like bcrypt (if your whole infrastructure happens to support such algorithms) but I think password complexity is enough to thwart most/all attacks.
Just make your password very complex and the brute force is not much of an issue. Of course, not many people will go for that idea... Probably the best compromise is to review the advancement of password cracking technology over cost and compare that to the required complexity of a password to survive for at least 120 days without being cracked, and make your password complexity at least stronger than that. You can attempt relying on things like bcrypt (if your whole infrastructure happens to support such algorithms) but I think password complexity is enough to thwart most/all attacks.